mail[.]dletters[.]com

Analysis of mail.dletters.com shows an active generic phishing infrastructure that began operating shortly after the domain was registered on February 8 2025. The site returns HTTP 200 and presents the page title “Roundcube Webmail :: Bienvenue à Roundcube Webmail”, indicating the use of the open‑source RoundCube webmail interface. Technical fingerprinting reveals a stack composed of PHP, Bootstrap, Nginx, jQuery UI and jQuery, with HTTP Strict Transport Security (HSTS) enforced. The domain resolves to IP 109.120.179.117, which is allocated to AS210644 (AEZA GROUP LLC) in Germany and is served through Cloudflare nameservers bristol.ns.cloudflare.com and finley.ns.cloudflare.com.

The SSL certificate is issued by Let’s Encrypt (R12), confirming the presence of TLS encryption. Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain is currently listed on one security blocklist; it is also flagged by the PhishDestroy service. VirusTotal reports that 2 of 93 security vendors have marked the domain as malicious, providing additional corroboration of its phishing intent.

Defenders should block the domain and its associated IP at perimeter firewalls and DNS filtering solutions, enforce TLS inspection to capture the underlying traffic, and monitor for any outbound connections to the identified IP. Because the underlying RoundCube deployment could be used to harvest credentials, organizations should audit mail authentication logs for unexpected logins from this host and consider enabling multi‑factor authentication for email services. Additional certainty is limited to the observed infrastructure; deeper payload analysis or credential harvesting mechanisms have not been publicly disclosed, so continuous monitoring of threat‑intel feeds for new indicators of compromise is advised.