dhlservicepoint[.]rs

This domain, dhlservicepoint.rs, is actively impersonating DHL as part of a phishing operation targeting users seeking international express delivery services. Analysis indicates the domain was registered on December 7, 2022, through Webglobe d.o.o. and remains operational as of July 12, 2026. The page title, 'DHL SERVICEPOINT | Međunarodna ekspresna dostava, proračun cene online,' explicitly references DHL services, reinforcing the brand impersonation classification. Infrastructure analysis reveals the domain resolves to IP address 81.95.110.236 and employs a Let's Encrypt SSL certificate, which is commonly used across both legitimate and malicious sites. Detected technologies include Nginx, Google Tag Manager, OneTrust, Stimulus, and YouTube, suggesting a structured web presence designed to appear authentic. However, the domain has been flagged by 14 of 95 security vendors in scans, and it appears on at least two security blocklists, including PhishDestroy and BLP-Malware. Additionally, the domain is referenced in 43 threat intelligence pulses on AlienVault OTX, further corroborating its malicious status. Trust assessment tools assign low scores to this domain, with Scamadviser rating it 40/100 and Gridinsoft assigning a 0/100 trust score. While the exact content and functionality of the site have not been fully analyzed, the combination of brand impersonation, active status, and security vendor detections confirms its role in phishing activity. Defenders should prioritize blocking this domain at the network level and monitoring for related infrastructure, particularly domains registered through the same registrar or resolving to the same IP address. Further investigation into associated email addresses, nameservers, or hosting providers may uncover additional linked threats.