dhl[.]webauthor[.]com

The domain dhl.webauthor.com is currently active and serves HTTP 200 responses. DNS queries resolve the host to the Cloudflare edge address 104.19.208.147, which belongs to AS13335 and is located in the United States. The domain is delegated to the Cloudflare name servers erin.ns.cloudflare.com and ivan.ns.cloudflare.com and was registered through Cloudflare, Inc. on 30 July 1995, indicating that the identifier has existed for decades but may have been repurposed for malicious use. A valid TLS certificate issued by Google Trust Services under the WE1 authority secures the site, providing the appearance of legitimacy. The page title reported by scanners is “DHL”, and the intelligence tag lists the brand target as DHL, confirming a brand‑impersonation motive.

Infrastructure analysis shows the presence of CFML, Adobe ColdFusion, Material Design Lite, Bootstrap, Moment.js, Marked, jsDelivr and jQuery UI libraries, suggesting a ColdFusion‑based web application that leverages common front‑end frameworks. Threat‑intel aggregators have flagged the domain: fifteen of ninety‑five VirusTotal scanners reported malicious behavior, it appears on one external blocklist, and PhishDestroy has explicitly blocked it. The Gridinsoft trust score is 0 out of 100, reinforcing a high‑risk assessment. No additional public repositories such as OTX or open‑source reports were found. Uncertainty remains around the exact payload delivered to victims; the crawled page content has not been disclosed, and no indicators of credential‑stealing forms or redirects have been published.

Consequently, defenders cannot confirm the full kill chain but can rely on the observed infrastructure and detection signals. Mitigation guidance recommends adding dhl.webauthor.