vampire[.]dj

This domain, vampire.dj, is actively flagged as a high-risk credential phishing site. Analysis indicates it was registered on February 21, 2026, and remains operational as of July 12, 2026. The domain resolves to 192.185.92.29, hosted on AS31898 (Oracle Corporation) in the United States, and returns a standard HTTP 200 status, suggesting an accessible web server. Nameservers ns1.dnsnetwork.de and ns2.dnsnetwork.de are configured, a pattern observed in other confirmed phishing infrastructure. The site uses a Let's Encrypt SSL certificate (R13), which provides encryption but does not validate legitimacy. Detected technologies include WordPress, MySQL, PHP, and Apache HTTP Server, alongside client-side libraries such as jQuery Migrate, Slick, prettyPhoto, and Lightbox—common components in both legitimate and malicious sites, though WordPress environments are frequently targeted for exploitation due to plugin vulnerabilities. The page title 'Maven Lore' offers limited insight into the specific target or brand impersonation, as no confirmed brand association is present in available data. However, the domain has been identified in 14 threat intelligence pulses and appears on two security blocklists, including PhishDestroy and PhishingDB. Fourteen security vendors on a recent scan have flagged the domain, reinforcing its classification as malicious. While the exact phishing lure or victim interaction model is not yet confirmed, the infrastructure and detection patterns align with credential harvesting operations. Defenders are advised to treat this domain as hostile, block resolution at the DNS level, and monitor for related indicators across network logs and endpoint telemetry. No evidence suggests takedown or remediation at this time.