homepage-krakecom[.]framer[.]ai

The domain homepage-krakecom.framer.ai is a phishing site engaged in brand impersonation targeting Kraken, a cryptocurrency exchange. It presents itself as a legitimate Kraken login page to deceive users into entering credentials, posing an elevated risk of credential theft and financial fraud. No cryptocurrency drainer kit was detected. The site is currently taken offline.

Technical indicators confirm the malicious nature of homepage-krakecom.framer.ai. As of analysis, 1 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing has not marked it as unsafe. The domain appears on 1 security blocklist, specifically PhishDestroy. Registered through CSC Corporate Domains, Inc. on January 06, 2018, it resolves to the IP address 35.71.142.77, hosted on Amazon.com, Inc. infrastructure in the US. The SSL certificate is issued by Let's Encrypt / E8, and the observed page title was 'Log In | Kraken.com'. Technologies detected include Framer Sites, React, HSTS, and HTTP/3. The domain uses nameservers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns.

Users who interacted with homepage-krakecom.framer.ai should immediately change their Kraken account passwords and enable two-factor authentication (2FA) if not already active. Monitor account activity for unauthorized transactions or login attempts. Report the phishing domain to Kraken's security team via their official support channels and submit the URL to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts. Avoid reusing passwords across services to mitigate further risk.