web-kraken-help[.]framer[.]ai

Analysis of web-kraken-help.framer.ai shows a confirmed brand‑impersonation infrastructure targeting Kraken users. The domain, registered through CSC Corporate Domains, Inc. on 06 January 2018, resolves to the Amazon‑owned address 52.223.52.2 (AS16509, United States). DNS is served by four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site presented a TLS certificate issued by Let’s Encrypt (E8) and enforced HSTS, indicating an attempt to appear legitimate.

HTTP probing returned a 404 status, and the page title captured during scanning was "Log‑in | Kraken.com," directly mirroring the legitimate exchange’s login portal. Technology fingerprints include Framer Sites, React, and HTTP/3, consistent with a modern web‑app front‑end. Security intelligence flags the domain as a crypto‑scam; it appears on a single external blocklist and was previously blocked by PhishDestroy. VirusTotal scans show seven of ninety‑five AV engines flagging the host, reinforcing the suspicion.

Current operational status is offline, limiting immediate threat exposure, but the infrastructure remains reusable for future impersonation campaigns. Defenders should continue to block the domain at perimeter filters, monitor the associated IP and name‑server set for re‑use, and add the observed TLS fingerprint to certificate‑pinning policies where applicable. Incident response teams should also update brand‑specific threat feeds for Kraken to include this indicator, and consider reviewing any recent authentication attempts that may have referenced the captured page title. Continuous observation of the registrar and hosting provider for new domains sharing the same registration pattern is advised to pre‑empt re‑deployment of the same impersonation kit.