welcome-kraken-ai[.]framer[.]media

Analysis of welcome-kraken-ai.framer.media shows a web presence that was deliberately taken offline as of the report date, July 25, 2026. The domain resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (ASN 16509) and is physically located in the United States. Registration was performed through CSC Corporate Domains, Inc., and the authoritative name servers are ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-1 (truncated), all consistent with Amazon Route 53 hosting. The site presented a TLS certificate issued by Let’s Encrypt (certificate profile E7), indicating a valid HTTPS endpoint despite the malicious purpose.

An HTTP request returned a 404 status code, yet the page title "KraKen® Account Login – How to Get Started Fast" was captured, confirming the intent to mimic the legitimate Kraken brand. Technology fingerprints include Framer Sites, React, HSTS enforcement, and HTTP/3 support, suggesting a modern web stack used to host the fraudulent login page. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans recorded 13 detections out of 93 security vendors, reinforcing the malicious classification.

Intelligence tags the site as a crypto‑related scam that impersonates Kraken, aligning with the "Crypto Scam" label in the source data. While the site is currently offline, its infrastructure—particularly the AWS IP range and the Let's Encrypt certificate—remains reusable for future campaigns. Defenders should continue to block the domain and associated IP address, monitor the listed nameservers for any re‑activation, and incorporate the observed TLS and technology signatures into detection rules. Ongoing vigilance is advised to catch any redeployment of the same hosting footprint for new impersonation attempts.