dhl-negombo[.]com

The domain dhl-negombo.com, registered through PDR Ltd. d/b/a PublicDomainRegistry.com, was created on July 08, 2017 and is currently offline. Infrastructure analysis shows the domain resolves to IP address 199.79.62.115, which is hosted in the United States under autonomous system AS46606 (Unified Layer). The domain is served by the nameservers ns1.md-54.webhostbox.net and ns2.md-54.webhostbox.net and does not present an SSL certificate, indicating an unencrypted HTTP service. Reputation metrics are extremely low: Scamadviser assigns a trust score of 1 out of 100 and Gridinsoft rates the site at 0 out of 100.

The page title observed during the brief observation was simply "DHL," and the threat type is classified as brand impersonation targeting DHL. Multiple external defenses have flagged the domain: it appears on one security blocklist and is explicitly blocked by PhishDestroy. Google Safe Browsing categorises the site as social engineering, and VirusTotal reports that 14 of 95 scanning engines flagged the domain as malicious. AlienVault OTX references the domain in 16 separate threat‑intel pulses, demonstrating continued reuse in broader campaigns.

While the exact content of the landing page was not captured, the combination of a trusted brand name in the title, the absence of TLS, and the low trust scores strongly suggest a credential‑harvesting or fraud operation. Defenders should add the domain and its resolving IP to deny‑lists, monitor for any re‑appearance on other hosting providers, and enforce strict outbound filtering for HTTP traffic to this address. Continuous monitoring of the associated ASN and related name‑server patterns is recommended to pre‑empt potential redeployment of the infrastructure.