tracking-package-global[.]vercel[.]app

The domain tracking-package-global.vercel.app is currently active and classified as a high-risk delivery scam. Analysis indicates the threat specifically impersonates DHL Express, a global logistics provider, to deceive users into interacting with fraudulent package tracking interfaces. This campaign is designed to harvest login credentials, personal information, and payment details under the guise of legitimate parcel delivery notifications. Infrastructure analysis reveals the domain is registered through Vercel Inc., a platform commonly used for hosting static web applications. The domain resolves to the IP address 216.198.79.195 and is flagged by 11 of 95 security vendors on VirusTotal, indicating a moderate to high level of detection. Additionally, the domain appears on one security blocklist, further corroborating its malicious classification. The SSL certificate is issued by Google Trust Services (WR1), which, while providing encryption, does not validate the legitimacy of the site’s content. The page title explicitly mimics DHL Express, reinforcing the impersonation tactic. As of the latest assessment, tracking-package-global.vercel.app remains active and continues to pose a significant risk to users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the associated IP address. Users who may have interacted with the site should immediately reset credentials for any accounts entered, monitor financial statements for unauthorized transactions, and report the incident to relevant fraud prevention authorities. Proactive measures, such as domain reputation checks and user education on delivery scam tactics, are recommended to mitigate further exposure.