stroy-portall[.]ru

This domain, stroy-portall.ru, is currently flagged for brand impersonation, specifically targeting DHL. The domain has been active since its creation on July 17, 2020, and is still operational as of July 12, 2026. Analysis indicates that the domain appears on two security blocklists, PhishDestroy and PhishingDB, and has been flagged by 14 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0 out of 100, reflecting a high level of suspicion and risk. The domain resolves to the IP address 92.53.96.153, which is located in Russia and is part of the AS9123 JSC TIMEWEB network. The domain is registered through REGRU-RU and uses nameservers provided by Timeweb. The infrastructure analysis reveals that the site is built using WordPress, MySQL, PHP, and other common web technologies such as Yoast SEO, Nginx, Yandex.Metrika, and Swiper. Despite the page title indicating a construction materials catalog, the domain is known to impersonate DHL, which is a concerning discrepancy. Defenders should treat this domain with high caution and consider it a potential threat. The exact content of the site has not been fully analyzed, but the combination of a misleading page title and the impersonation of a well-known brand suggests that it may be used for social engineering attacks. Given the high risk level and the active status of the domain, security teams are advised to block access to this domain and monitor for any related malicious activities. The SSL certificate is issued by Let's Encrypt, which is a common practice for phishing sites to gain user trust. Additionally, the domain is listed in 16 threat intelligence pulses on AlienVault OTX, further validating its malicious nature. Security professionals should also consider educating users about the risks of visiting untrusted domains and verifying the authenticity of communications from DHL or any other trusted brands.