pro-kraken-login-enus[.]framer[.]media

The domain pro-kraken-login-enus.framer.media was registered on February 21, 2026 through CSC Corporate Domains, Inc. and is hosted on Amazon’s AS16509 network, resolving to IP 52.223.52.2 located in the United States. Four AWS Route 53 nameservers (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-1) provide authoritative resolution. The site served an HTTPS certificate from Let’s Encrypt (E7) and advertised modern transport layers including HSTS and HTTP/3. Automated fingerprinting identified Framer Sites and a React front‑end, consistent with a quickly assembled clone page.

The HTTP response returned a 404 status code, indicating the page is no longer reachable; the operational status is recorded as offline and the domain has been taken down. The page title that was observed reads “Kraken Pro Login® – Access Your Crypto Trading Account Securely,” directly referencing the Kraken brand and aligning with the declared scam type of a crypto‑related impersonation. VirusTotal scans recorded 13 detections out of 93 security vendors, and the domain appears on three external blocklists. It has also been flagged by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk brand‑impersonation vector.

Evidence points to a short‑lived credential‑harvesting campaign targeting Kraken users, leveraging a legitimate‑looking Framer hosting environment to lend credibility. Uncertainty remains regarding the exact payload delivered before takedown; no additional infrastructure such as command‑and‑control servers or malicious binaries has been disclosed. Defenders should immediately block the domain and its associated IP address, monitor for other framer.media subdomains employing similar naming patterns, and enforce strict brand‑watch rules for Kraken‑related login URLs. Continuous re‑inspection of related DNS records and periodic VirusTotal rescans are advised to catch any re‑emergence of the threat.