portal-kraken-eng[.]framer[.]ai

Analysis of portal-kraken-eng.framer.ai reveals a crypto phishing domain targeting Kraken users, currently offline but previously flagged by security vendors. The domain, registered on January 6, 2018, through CSC Corporate Domains, Inc., resolves to IP 35.71.142.77 (AS16509, Amazon.com, Inc., US) and was detected on at least one security blocklist (PhishDestroy). Eight of 95 security vendors on VirusTotal flagged this domain, indicating elevated risk prior to its takedown. The page title, 'Kraken Login : Buy and sell crypto securely,' directly aligns with Kraken's branding, confirming the impersonation attempt.

Infrastructure analysis shows the domain uses Framer Sites and React, with HSTS and HTTP/3 enabled, suggesting a modern web stack. Nameservers are hosted on AWS (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns), and the SSL certificate is issued by Let's Encrypt (E8). The domain returned an HTTP 404 status at the time of assessment, consistent with its offline status.

While the exact content and functionality of the site remain unconfirmed due to its current inaccessibility, the combination of brand impersonation, crypto-themed page title, and detection by multiple security vendors supports its classification as a crypto scam. Defenders should treat this domain as malicious, monitor for re-emergence under similar infrastructure, and block traffic to the associated IP and nameservers. No evidence links this domain to legitimate Kraken services, and the use of a third-party hosting provider (Amazon) is typical for phishing campaigns.