sso-en-kraken-public[.]framer[.]media

The domain sso-en-kraken-public.framer.media was observed hosting a credential‑harvesting page that mimics the official Kraken cryptocurrency exchange. The site is currently offline, returning an HTTP 404 status, and has been removed from public access. Infrastructure analysis shows the domain resolves to the IP address 35.71.142.77, an Amazon Web Services host located in the United States and assigned to ASN 16509 (Amazon.com, Inc.). The domain uses the four standard AWS name servers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-97.awsdns-).

The TLS certificate is issued by Let’s Encrypt (certificate identifier E7), indicating the site employed HTTPS despite its malicious intent. The page title captured during the brief observation period was "Kraken - Kraken | Buy, Sell and Margin Trade Bitcoin …," directly referencing the targeted brand. The site was registered on 19 November 2021 through CSC Corporate Domains, Inc., a registrar that frequently appears in abuse reports. Detection data shows that ten of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site was listed on a single security blocklist.

PhishDestroy also reported the domain as blocked, confirming that at least one commercial phishing‑mitigation service recognized the threat. The combination of brand impersonation, the use of a reputable SSL provider, and the presence of modern web technologies such as React, HSTS, and HTTP/3 suggests a relatively sophisticated phishing kit, likely designed to harvest Kraken user credentials for a crypto‑draining campaign. Defenders should update web filtering and DNS blocklists to include the domain and its associated IP address, monitor for any resurgence of the same infrastructure under different hostnames, and enforce multi‑factor authentication for Kraken accounts to mitigate credential reuse.