dh1-es-lnfo[.]cfd

This domain, dh1-es-lnfo.cfd, represents a targeted phishing campaign designed to impersonate postal service tracking systems, specifically leveraging the Serbian phrase 'Праћење пошиљке' (translation: 'Shipment Tracking'). The site aims to deceive users into entering sensitive information, such as login credentials, personal details, or financial data, under the guise of tracking a parcel. The use of a non-Latin script and a contextually relevant phrase suggests a localized attack vector, likely targeting Serbian-speaking individuals or those expecting international shipments from the region. Analysis of the page title and domain structure indicates an attempt to exploit trust in postal services, a common tactic in credential harvesting and identity theft operations. Infrastructure analysis reveals multiple high-risk indicators associated with dh1-es-lnfo.cfd. The domain was registered on December 12, 2025, through Aceville Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 43.165.68.229, which has been linked to other phishing infrastructure in recent months. Detection metrics further confirm the malicious nature of this domain: 17 out of 95 security vendors on VirusTotal have flagged it as phishing, while Google Safe Browsing has explicitly classified it as a phishing threat. Additionally, the domain appears on one security blocklist, and the absence of an SSL certificate further undermines its legitimacy. The combination of these technical indicators, alongside the domain's offline status, suggests a reactive takedown following detection, though similar domains may remain active. Users who have visited dh1-es-lnfo.cfd or interacted with its content should take immediate remedial actions to mitigate potential risks. First, any credentials or personal information entered on the site should be considered compromised and changed immediately across all platforms where they were reused. Affected individuals should monitor their financial accounts and credit reports for unauthorized activity, as phishing sites of this nature often serve as precursors to identity theft or financial fraud. If the site was accessed via a corporate or institutional device, the organization's IT security team should be notified to conduct a forensic analysis. Finally, users are advised to verify the legitimacy of any postal tracking links by cross-referencing them with official service providers and to employ browser-based security tools that block known phishing domains.