help-en-kraken-app[.]framer[.]media

This domain, help-en-kraken-app.framer.media, poses a high-risk brand impersonation threat targeting Kraken cryptocurrency exchange users. Analysis indicates the site mimics the official Kraken login portal, presenting a fraudulent interface titled 'Kraken Login Portal | Start Trading Crypto..' to harvest user credentials. The infrastructure is designed to deceive victims into entering sensitive account details, which are then exfiltrated to threat actor-controlled servers for unauthorized access or financial theft. Technical evidence confirms the malicious nature of this domain. VirusTotal detection reports 11 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to IP address 52.223.52.2, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Additionally, the domain appears on one security blocklist and is secured with a Let's Encrypt SSL certificate (serial number E7), a common tactic to lend superficial legitimacy to phishing sites. Users who visited help-en-kraken-app.framer.media should assume their credentials were compromised. Immediate action is required: revoke any active sessions, enable multi-factor authentication on all accounts, and monitor for unauthorized transactions. If financial data or recovery codes were entered, contact Kraken support to report the incident and secure the account. Additionally, scan local devices for malware, as phishing sites may deploy secondary payloads. This domain has since been taken offline, but similar threats may persist under different addresses.