mail-jdhlilinlink[.]appwrite[.]network

This domain, mail-jdhlilinlink.appwrite.network, poses a credential harvesting threat by impersonating DHL, a global logistics provider. Visitors to the site encounter a fraudulent login page titled 'Sign In,' designed to deceive users into submitting sensitive account details such as usernames, passwords, or shipment tracking credentials. The site exploits trust in the DHL brand to facilitate unauthorized access to personal or corporate data, potentially leading to financial fraud or identity theft. Analysis indicates the domain was registered on March 12, 2026, through the Appwrite registrar and resolves to the IP address 151.101.131.52, hosted on infrastructure belonging to AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Certainly, a provider commonly used for both legitimate and malicious domains. Detection engines on VirusTotal flagged the domain as malicious, with 20 out of 95 security vendors identifying it as a phishing site. Additionally, the domain appears on one security blocklist, further confirming its malicious intent. If you or someone in your organization visited mail-jdhlilinlink.appwrite.network and entered credentials, immediate action is required. First, reset the password for any accounts accessed through the site, using a strong, unique password not reused elsewhere. Enable multi-factor authentication where available to add an extra layer of security. Monitor accounts for unauthorized activity, such as unexpected shipments, password changes, or financial transactions. If payment details were submitted, contact your financial institution to report potential fraud and request a card replacement. Finally, report the incident to your organization’s IT or security team for further investigation and mitigation.