app-kraken-help[.]framer[.]ai

The domain app-kraken-help.framer.ai has been identified as a brand impersonation threat targeting the cryptocurrency exchange Kraken. This phishing site attempts to trick users into entering their login credentials under the guise of a legitimate Kraken login page. The page title observed was 'Kraken Login | Buy, Sell and Margin Trade Bitcoin …', which closely mimics the official Kraken interface. PhishDestroy categorizes this as a high-risk phishing campaign designed to harvest sensitive account information.

Technical indicators reveal a clear picture of malicious intent. VirusTotal data shows that 11 out of 95 security vendors flag this domain as malicious, and it appears on 3 security blocklists. The domain resolves to IP address 52.223.52.2 and was created on January 6, 2018, registered through CSC Corporate Domains, Inc. Google Safe Browsing also flags the domain for phishing activity. The SSL certificate is issued by Let's Encrypt with fingerprint E8, which is commonly abused by threat actors due to its free and automated issuance process.

As of the latest check, the phishing site has been taken offline, indicating that response actions have been taken to mitigate the threat. However, the domain remains registered and could potentially be reactivated or used for future attacks. Users who may have interacted with this site should change their Kraken credentials immediately and enable two-factor authentication. It is also advisable to monitor accounts for any unauthorized transactions and report any suspicious activity to Kraken support. PhishDestroy continues to monitor this domain for any changes in status or new malicious activity.