sgin12-dhl[.]mdbgo[.]io

This report details a malicious domain impersonating DHL to facilitate a shipping scam. The site, titled "DHL | Tracking System," poses as a legitimate DHL tracking portal. The threat is that unsuspecting users may be tricked into entering personal or financial information under the pretense of tracking a package, leading to credential theft or fraud.

Technical analysis confirms the malicious nature of the domain. VirusTotal flags it with 22 detections out of 95 security vendors. The domain was registered through OVH SAS and created on 2020-10-19. It resolves to IP address 93.105.88.616, hosted in Poland by AS50606 Horyzont Technologie Internetowe sp.z.o.o. The site uses a Let's Encrypt SSL certificate (R13) and is flagged by two blocklists. Notable vendors detecting the threat include ADMINUSLabs, Criminal IP, BitDefender, Cluster25, and CyRadar.

The domain is currently offline and inaccessible. Its GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, indicating a high level of threat. The risk level remains elevated due to the site's impersonation of a major brand and its history of malicious detection.