kr-flame[.]vercel[.]app

This domain, kr-flame.vercel.app, is confirmed as an active phishing site specializing in brand impersonation targeting DHL, a global logistics provider. The page mimics DHL’s official tracking system, presenting a fraudulent interface labeled 'DHL | Tracking System' to deceive users into entering sensitive credentials or payment information. No crypto drainer components were observed, but the site’s design and structure align with credential harvesting tactics commonly employed in logistics-themed phishing campaigns. Analysis of technical indicators reveals significant red flags. The domain is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. Registered through Tucows Domains Inc. on February 21, 2026, the domain resolves to IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 root, a common but not exclusive indicator of legitimacy. Despite its recent creation date, the domain appears on one security blocklist, suggesting early detection by at least one threat intelligence feed. As of the latest verification, kr-flame.vercel.app remains active, posing an ongoing risk to users. The domain’s infrastructure, including its hosting provider and registrar, has not yet taken enforcement action, allowing the phishing content to persist. Organizations and individuals are advised to block the domain and its associated IP at the network level, while end-users should avoid interacting with any unsolicited DHL-themed communications. Continuous monitoring of related domains registered through the same registrar or resolving to similar IP ranges is recommended to mitigate further exposure.