kracen-support[.]framer[.]ai

The domain kracen-support.framer.ai is currently offline, returning HTTP 404 for all requests. It was registered on January 6, 2018 through CSC Corporate Domains, Inc. and is hosted on Amazon AWS (AS16509) in the United States, resolving to 52.223.52.2. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. TLS is provided by a Let’s Encrypt certificate (issuer E8) and the site advertised HSTS and HTTP/3 support, built on Framer Sites and React frameworks.

Google Safe Browsing flags the domain for social engineering, and nine of ninety‑five VirusTotal scanners have raised detections. The domain appears on a single public blocklist and is listed by PhishDestroy as a known malicious entry. The page title retrieved before takedown reads “Kraken - Kraken | Trade Bitcoin …”, matching the targeted brand Kraken and confirming a crypto‑related impersonation campaign.

No additional payload, credential‑harvesting form, or redirect information is publicly disclosed, so the exact attack vector remains uncertain. Analysts should continue to monitor the domain’s DNS and IP for any re‑activation, update local and network‑level block lists with the IP 52.223.52.2 and the full set of name servers, and ensure that endpoint protection solutions reference the Google Safe Browsing and VirusTotal findings. Organizations using Kraken services should educate users about the existence of this impersonation site and enforce multi‑factor authentication to mitigate credential compromise.