mailer3-dhl[.]mdbgo[.]io

This domain, mailer3-dhl.mdbgo.io, is identified as a credential phishing site impersonating DHL, a global logistics provider. The site presents a fraudulent login interface titled 'Sign In.' designed to harvest user credentials. Such impersonation attacks exploit brand trust to deceive victims into entering sensitive information, which can then be used for unauthorized access, financial fraud, or further phishing campaigns targeting corporate or personal accounts. Analysis indicates this domain was registered on October 19, 2020, through OVH SAS, a known registrar frequently used in phishing operations. It resolves to the IP address 93.105.88.216, located in Poland under AS50606 (Horyzont Technologie Internetowe sp.z.o.o.). The domain is flagged by 23 out of 95 security vendors on VirusTotal, a clear indicator of malicious intent. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB, and uses a Let's Encrypt SSL certificate (R13), which while legitimate, is commonly abused by threat actors to lend false credibility to phishing sites. If you or someone in your organization visited mailer3-dhl.mdbgo.io and entered credentials, immediate action is required. First, reset the compromised password on the legitimate DHL platform and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unexpected password reset emails, login attempts from unfamiliar locations, or unusual transactions. If financial or sensitive corporate data was exposed, report the incident to your internal security team or a cybersecurity professional for further investigation. Finally, ensure your security tools are updated to block this domain and its associated IP address to prevent future access.