public-kraken-eng-web[.]framer[.]ai

public-kraken-eng-web.framer.ai was observed by multiple security services and is currently classified as a crypto‑related brand‑impersonation campaign targeting Kraken customers. The domain was registered on 21 February 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 52.223.52.2, which belongs to ASN 16509 (Amazon.com, Inc.) in the United States. Four AWS Route 53 nameservers are configured (ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns‑15.net, ns‑1198.awsdns‑21.org, and a fourth entry truncated in the source data), indicating the infrastructure is hosted on a standard cloud platform. TLS termination is provided by a Let’s Encrypt certificate (issuer “E8”), and the service advertises modern protocols such as HTTP/3 together with HSTS. Automated fingerprinting identified the use of Framer Sites and the React JavaScript framework, which are commonly leveraged to rapidly deploy counterfeit pages.

An HTTP request to the domain returns a 404 status code and the page title “Site Not Found | Framer”, suggesting that the malicious landing page has been removed or is temporarily unavailable. VirusTotal recorded detections by four of ninety‑three scanning engines, reinforcing the malicious classification. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy remediation service. The overall risk rating is elevated, and the current operational status is reported as offline.

Defenders should add the domain and its resolving IP address to deny‑list rules at perimeter devices and DNS filtering solutions. Because the underlying cloud host is shared, monitoring for additional subdomains created under the same nameserver set may uncover related campaigns. Continuous telemetry from threat‑intel feeds that reference the same registrar or ASN can aid in early detection of future impersonation attempts.