help-kraken-docs[.]framer[.]media

The domain help-kraken-docs.framer.media was registered on November 19, 2021 through CSC Corporate Domains, Inc. and is hosted on Amazon’s AS16509 network in the United States, resolving to IP address 52.223.52.2. The site was built with Framer Sites and React, and it served content over HSTS and HTTP/3, indicating a modern web stack. A Let's Encrypt certificate (E7) was observed, confirming the use of a valid TLS certificate but offering no assurance of legitimacy. The page title returned by the server was "Kraken Login Troubleshooting: A Step‑By‑Step Guide," and the HTTP response code was 404, suggesting the expected content was not served at the time of analysis.

Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded 12 detections out of 95 scanned vendors, reinforcing the malicious classification. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. The content impersonates the cryptocurrency exchange Kraken, aligning with a broader crypto‑scam campaign.

Current observations indicate the domain has been taken offline, but its infrastructure—particularly the Amazon‑hosted IP and the Framer‑based site—remains reusable. Defenders should continue to monitor the IP address and associated nameservers (ns-1267.awsdns-30.org, ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-) for any re‑activation, block the domain and IP at perimeter defenses, and update detection rules to capture similar Framer‑site patterns targeting Kraken. Further investigation is needed to determine whether the site ever delivered credential‑stealing forms or other payloads, as the available evidence is limited to registration, hosting, and surface‑level indicators.