secure-kraken-logi[.]framer[.]ai

This domain, secure-kraken-logi.framer.ai, was first observed on February 21, 2026 and is associated with a brand‑impersonation campaign targeting Kraken. The site presented a 404 HTTP response with the page title “Site Not Found | Framer”, indicating that the malicious landing page is no longer reachable. Infrastructure analysis shows the domain resolves to 52.223.52.2, an Amazon Web Services host in the United States (AS16509, Amazon.com, Inc.). The certificate presented is a Let’s Encrypt E8 certificate, which does not provide brand‑specific validation. Registration was performed through CSC Corporate Domains, Inc., and the domain uses four AWS name‑servers (ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns‑15.net, ns‑1198.awsdns‑21.org, and an additional unnamed server).

The campaign has been classified as a crypto‑scam, and the domain appears on a single blocklist, PhishDestroy. VirusTotal scans returned six positive detections out of ninety‑three scanners, confirming that multiple security vendors consider the domain malicious. The current status is offline, and the risk rating is elevated. Available evidence confirms the use of legitimate cloud infrastructure and a free TLS certificate, a pattern often employed to lend credibility to fraudulent sites.

The lack of a live payload prevents detailed forensic assessment of the phishing kit or credential‑harvesting mechanisms. Defenders should continue to block the IP address 52.223.52.2 and the domain itself in network filters, add the domain to internal threat‑intel feeds, and monitor for newly registered subdomains that reuse the same registrar or name‑server pattern. Ongoing observation of related AWS‑hosted infrastructure is recommended, as adversaries frequently pivot to adjacent IP ranges when a single host is taken down. Because the site is already offline, rapid takedown is not applicable, but continued vigilance is required to detect any resurgence of the campaign under a different domain.