dhlcanada[.]com

This domain, dhlcanada.com, poses a significant threat as a brand impersonation site targeting DHL Express customers in Canada. Attackers designed the page to replicate the official DHL website, using the title 'DHL Express | Canada' to deceive visitors into entering sensitive information such as login credentials, shipping details, or payment data. Such impersonation sites are commonly used in phishing campaigns to harvest user data for fraud, identity theft, or unauthorized financial transactions. The domain’s infrastructure and design closely mimic legitimate DHL services, increasing the likelihood of successful deception among unsuspecting users. Analysis indicates this domain is malicious based on multiple technical indicators. VirusTotal reports that 20 out of 95 security vendors have flagged dhlcanada.com as malicious, with Google Safe Browsing specifically labeling it as a phishing site. The domain was registered on December 27, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, and resolves to the IP address 103.124.107.10, hosted by AS142036 Hosteons Pte. Ltd. in the United States. The SSL certificate, issued by Let's Encrypt, does not validate the site's legitimacy, as malicious actors frequently use free certificates to appear trustworthy. Additionally, the domain appears on one security blocklist, further confirming its high-risk status. Users who visited dhlcanada.com should take immediate action to mitigate potential risks. First, disconnect the device from the network to prevent any ongoing data exfiltration. Run a full antivirus scan to detect and remove any malware that may have been downloaded. If any credentials or financial information were entered on the site, change passwords immediately for all associated accounts, particularly those linked to DHL, banking, or email services. Enable multi-factor authentication where available to add an extra layer of security. Monitor financial statements and credit reports for unauthorized activity, and report any suspicious transactions to the relevant institutions. Finally, notify local cybersecurity authorities or the legitimate DHL security team to assist in tracking and mitigating the threat.