kreken-ens[.]framer[.]ai

The domain kreken-ens.framer.ai is currently offline, returning an HTTP 404 response. It was registered on April 04 2023 through CSC Corporate Domains, Inc., and is hosted on Amazon’s infrastructure (ASN 16509) at IP 52.223.52.2, which resolves to a United States location. The domain’s authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, confirming use of AWS DNS services. A publicly trusted TLS certificate issued by Let’s Encrypt (certificate identifier E8) is present, and the site advertised HSTS and HTTP/3 support, indicating a modern web stack. Technology fingerprinting identified Framer Sites and a React framework, consistent with the use of the framer.ai hosting platform.

Content metadata includes the page title “Kraken Login | Secure Access to Your Crypto Trading Account,” directly referencing the Kraken brand and suggesting a credential‑harvesting intent. The threat classification is recorded as a crypto‑related scam, and the domain is listed on a single security blocklist. Google Safe Browsing flags the site for social engineering, and PhishDestroy has actively blocked it. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain, providing additional corroboration of malicious behavior.

While the site is no longer reachable, the combination of brand‑specific page title, observed hosting on a legitimate cloud provider, a valid TLS certificate, and multiple independent detections establishes a high confidence that the domain was employed for brand impersonation targeting Kraken users. Uncertainty remains regarding the exact payload or credential capture mechanism because the page content was not captured before takedown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future sub‑domains that may reuse the same name servers or IP range, and educate Kraken customers about unsolicited login requests.