smh-ejendomsservice[.]dk

This domain, smh-ejendomsservice.dk, was actively engaged in brand impersonation targeting DHL, a global logistics provider, to facilitate credential theft. The site presented a fraudulent login interface mimicking DHL’s official portal, designed to harvest user credentials, including account details and personal information. Such impersonation attacks are commonly used to gain unauthorized access to corporate or customer accounts, enabling further fraudulent activities such as unauthorized shipments, financial theft, or data exfiltration. Analysis of the domain’s infrastructure reveals multiple high-risk indicators. The domain was registered on December 02, 2024, through ONE.COM A/S and resolved to the IP address 144.172.109.71, hosted under AS14956 (RouterHosting LLC) in the United States. It was flagged by Google Safe Browsing as phishing and appeared on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate, issued by Let’s Encrypt (serial number prefix E8), was used to lend a false sense of legitimacy. VirusTotal detection rates further confirm the malicious nature of the domain, with 20 out of 95 security vendors marking it as malicious. Users who visited smh-ejendomsservice.dk or interacted with its content should take immediate remedial actions. Those who entered credentials should assume their accounts are compromised and initiate password resets for all associated services, particularly DHL accounts. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial and shipment activity for signs of fraudulent transactions. If corporate credentials were entered, notify internal security teams to assess potential lateral movement or data exposure risks. The domain has since been taken offline, but users should remain vigilant for similar impersonation attempts using other domains or communication channels.