en-us-krakn-portal[.]framer[.]media

Analysis of en-us-krakn-portal.framer.media indicates this domain was actively used for brand impersonation targeting Kraken, a cryptocurrency exchange. The domain was registered on November 19, 2021, through CSC Corporate Domains, Inc., and resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. The SSL certificate is issued by Let's Encrypt, and the domain uses AWS nameservers, consistent with legitimate web infrastructure but commonly abused for phishing. As of July 24, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline or suspended, though no confirmation of enforcement action is available.

The page title, 'Kraken: Buy and sell crypto securely,' directly matches Kraken's branding, confirming intent to impersonate the exchange for fraudulent purposes. The domain appears on one security blocklist (PhishDestroy) and was flagged by 11 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. Detected technologies include Framer Sites, React, HSTS, and HTTP/3, which are not inherently malicious but are frequently used in phishing campaigns due to their ease of deployment and modern web capabilities. No evidence of active malicious content is currently observable due to the 404 status, but historical context and detection data support classification as a crypto scam.

Defenders should treat this domain as compromised and block it across security controls. Monitoring for re-activation or similar domains using the same infrastructure (e.g., Framer Sites, AWS hosting) is recommended. The domain's registration age and hosting provider do not alone indicate legitimacy, particularly given the confirmed brand impersonation and detection history.