dhl[.]order1196[.]sbs

On July 23, 2026, analysis of the domain dhl.order1196.sbs was completed. The domain was registered on 22 November 2025 via Web Commerce Communications Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution uses the Cloudflare name servers aldo.ns.cloudflare.com and desi.ns.cloudflare.com. No TLS certificate is presented, meaning the site operates over plain HTTP, which reduces credibility and increases interception risk. Google Safe Browsing has flagged the URL for social engineering, and the Gridinsoft trust score is 0 out of 100, indicating a lack of reputation.

VirusTotal scans show that 12 of 95 security vendors have identified the domain as malicious, reinforcing the suspicion. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service. The page title returned by HTTP requests is “DHL | 6kmXJPeB1BYQlRez”, a string that does not correspond to the advertised brand. The domain is known to impersonate the Curve brand, suggesting that the operator is leveraging Curve’s brand reputation to lure victims. No further content has been captured because the site is currently offline, limiting visual analysis.

Given the combination of a recent registration, lack of TLS, low trust score, multiple vendor detections, and explicit Safe Browsing warning, the domain should be considered high‑risk. Defensive actions include adding the hostname to network and email blocklists, configuring web proxy filters to deny traffic to the resolved IP address, and monitoring for newly created sub‑domains that follow the same naming pattern. Continuous observation of Cloudflare‑hosted infrastructure for similar phishing campaigns is also recommended. Incident response teams should treat any communications referencing this domain as potentially malicious and advise users to avoid interaction.