isamalta[.]org

Analysis of isamalta.org, first observed in security feeds on June 8, 2018, indicates active abuse as a brand‑impersonation site targeting DHL. The domain resolves to IP 65.60.45.202, hosted in the United States under ASN AS32475 owned by Internap Holding LLC. Infrastructure inspection shows the web server is Apache HTTP Server and the site presents an HTTP 403 response, suggesting restricted or error‑page content. The TLS certificate is issued by Let’s Encrypt (R13) and therefore provides encryption without authenticating the operator. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a common registrar for disposable or low‑cost domains.

Reputation data is poor: Gridinsoft assigns a trust score of 1 out of 100, and the domain appears on one security blocklist. VirusTotal scanning reports that four of ninety‑five AV engines flagged the host, confirming malicious activity. AlienVault OTX lists the domain in a single threat pulse, and PhishDestroy has already blocked it.

The public page title reads “Industries Sports Association,” which does not align with DHL’s branding, indicating a mismatch between the advertised content and the claimed target. Defenders should block DNS resolution to 65.60.45.202, add isamalta.org to URL filtering and email security policies, and monitor for any future variations of the domain or its nameservers (ns29.superdnssite.com, ns30.superdnssite.com, ns41.superdnssite.com, ns42.superdnss). Continuous threat‑intel feeds should be consulted for new indicators of compromise associated with this infrastructure.