dhlitaliam-lang[.]github[.]io

PhishDestroy identifies dhlitaliam-lang.github.io as a malicious domain currently active and under investigation for involvement in a delivery scam campaign. This domain mimics legitimate DHL Italy communications to deceive users into disclosing personal or financial information under the guise of package delivery notifications. The risk level remains under investigation pending further behavioral analysis and corroborating threat intelligence.

This domain was flagged by zero of 95 VirusTotal vendors and remains undetected in current threat repositories. It is registered through GitHub, Inc., resolves to IP address 185.199.108.153, and operates under a Let’s Encrypt SSL certificate. Despite its absence in blocklists, the domain’s association with a known brand impersonation pattern raises immediate red flags. Additionally, its GitHub-hosted infrastructure leverages reputable domains to bypass traditional email filtering mechanisms, increasing delivery success rates for phishing lures. The use of GitHub Pages for hosting suggests a short-lived, opportunistic campaign designed to exploit trusted cloud platforms.

Given the active status and undetected nature of this domain, immediate precautionary measures are advised. Organizations and end users should block access to dhlitaliam-lang.github.io at the network and endpoint levels using DNS and firewall rules. Employees should undergo targeted phishing awareness training emphasizing scrutiny of non-standard domains and delivery notifications, especially those hosted on GitHub Pages. Additionally, this indicator should be ingested into SIEM correlation rules and shared via threat intelligence platforms to preempt broader campaign deployment. Security teams are urged to monitor for related infrastructure and report any observed interactions to their threat intelligence providers for rapid dissemination.