grand-jelly-75f494[.]netlify[.]app

This domain is flagged as a high-risk phishing site specializing in brand impersonation targeting DHL Express. The threat involves fraudulent web pages designed to harvest credentials, payment details, or personal information by mimicking official DHL communications and tracking portals. The page title 'DHL EXPRESS' and visual elements closely replicate legitimate DHL branding, increasing the likelihood of successful deception among targeted users. Analysis indicates the domain grand-jelly-75f494.netlify.app was registered on February 21, 2026, through Name.com, Inc., under the Netlify hosting platform. It resolves to IP address 35.157.26.135, geolocated in Germany and associated with AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 intermediate. Detection metrics reveal 22 out of 95 security vendors on VirusTotal flagged the domain as malicious. Google Safe Browsing classifies the site as phishing, and it appears on at least one security blocklist. The domain has since been taken offline, though historical activity remains a concern. Mitigation against brand impersonation phishing requires multi-layered defenses. Organizations should implement email filtering rules to block messages containing known malicious domains or suspicious DHL-related subject lines. Endpoint protection solutions should be configured to detect and block access to newly registered domains, particularly those hosted on cloud platforms with low reputation. User training should emphasize verification of sender domains, avoidance of embedded links in unsolicited tracking notifications, and direct navigation to official DHL portals via bookmarked or manually entered URLs. Security teams are advised to monitor for indicators of compromise, including the domain, IP address 35.157.26.135, and associated SSL certificate thumbprint, to prevent lateral movement or data exfiltration.