dhl[.]check8810[.]sbs

The domain dhl.check8810.sbs impersonates DHL in a shipping scam. It was flagged by 10 out of 95 vendors on VirusTotal and is listed on one public blocklist, specifically PhishDestroy. Google Safe Browsing also flags this domain. The site is currently taken down and offline, reducing its immediate threat.

Registered through Web Commerce Communications Limited and hosted on an IP managed by Cloudflare, Inc., the domain lacks an SSL certificate, which is a common trait among phishing sites aiming to cut costs and avoid detection. The domain was created on November 27, 2025, and detected by PhishDestroy the following day, indicating rapid identification and response to this threat.

The scam targets DHL customers, likely aiming to trick them into revealing personal or financial information under the guise of shipping updates or issues. The use of a recognizable brand like DHL increases the likelihood of users falling victim to the scam. The platform risk score for this domain is relatively low at 25/100, suggesting limited sophistication in its execution. However, its presence on multiple security lists underscores its malicious intent. Despite being offline, the domain's existence underscores the ongoing risk of brand impersonation in phishing campaigns.