help-kraken-ia[.]framer[.]photos

On July 24, 2026, the domain help-kraken-ia.framer.photos was observed in an offline state but retains artifacts that indicate a high‑risk brand‑impersonation campaign targeting users of the cryptocurrency exchange Kraken. The site was registered on 19 November 2021 through CSC Corporate Domains, Inc., and is hosted on Amazon’s infrastructure (ASN 16509) in the United States, resolving to 52.223.52.2. DNS resolution lists four AWS name servers (ns-1175.awsdns-18.org, ns-1631.awsdns-11.co.uk, ns-816.awsdns-38.net, ns-195.awsdns). The web server presented a TLS certificate issued by Let’s Encrypt (E7) and advertised HSTS and HTTP/3 support, while the underlying stack included Framer Sites and React. An HTTP request returned a 404 status code and the page title captured was “Sign In | Kraken® - Login In to Your Account*”, matching the brand target.

The page title and the declared impersonation of Kraken confirm the campaign’s intent to harvest credentials for a crypto‑related scam. Threat intelligence aggregators flagged the domain: Google Safe Browsing classified it as social‑engineering, VirusTotal recorded detections by 11 of 95 scanned vendors, and a single security blocklist listed the host, which is also blocked by the PhishDestroy feed. The combination of brand impersonation, the “Crypto Scam” label, and the presence on multiple threat‑intel sources elevates the risk to high. Uncertainty remains regarding the current operational status of the infrastructure, as the site is presently offline and no live content is reachable.

However, the persistence of the domain, its resolver configuration, and the historical detection record suggest that the infrastructure could be re‑activated or reused in future campaigns. Defenders should add the domain and its associated IP address (52.223.52.2) to block lists, monitor DNS queries for the four AWS name servers, and enforce outbound filtering for HTTP/HTTPS traffic to the identified page title pattern.