dhl[.]n24order[.]rest

The domain dhl.n24order.rest was observed hosting a brand‑impersonation site targeting DHL. The domain was registered on 21 November 2025 through Web Commerce Communications Limited and resolves to the Cloudflare address 172.67.212.99, associated with ASN 13335 in the United States. DNS resolution uses the Cloudflare authoritative nameservers rajeev.ns.cloudflare.com and roxy.ns.cloudflare.com. No TLS certificate is presented; HTTPS connections terminate without a valid certificate, which is consistent with a hastily deployed malicious landing page.

The HTTP response returns the page title “Just a moment…”, but no further content has been captured. Threat intelligence platforms have flagged the domain on a single security blocklist and PhishDestroy has already taken the site offline. VirusTotal analysis shows that 7 of 95 scanners reported malicious activity, reinforcing the suspicion of abuse. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of compromise.

The site’s current offline status limits active probing, but the underlying infrastructure—Cloudflare front‑end and the registrar—remains usable for future campaigns. Defenders should continue to block the domain at DNS and proxy layers, monitor the IP address 172.67.212.99 for any resurgence, and add the domain to internal watchlists for brand‑specific phishing alerts. Additional investigation is needed to retrieve the original payload, assess whether credential‑harvesting forms were employed, and determine if related sub‑domains exist. Until further evidence is gathered, the domain should be treated as a confirmed malicious indicator.