vinted[.]dhl118[.]com

PhishDestroy identifies an active delivery scam domain, vinted.dhl118.com, currently under investigation for impersonating DHL shipping services. The domain is associated with a fraudulent campaign designed to deceive users into divulging sensitive information under the guise of package delivery updates. As of the latest assessment, this domain remains active and poses a credible threat to end-users engaging with unsolicited shipping notifications. vinted.dhl118.com was flagged by 4 of 95 VirusTotal vendors, indicating no immediate detection by automated security tools despite its malicious intent. The domain resolves to IP address 188.114.97.3 and operates under an SSL certificate issued by Let’s Encrypt for deceptive legitimacy. It was registered through Gname.com Pte. Ltd. and was created on May 23, 2012, suggesting potential long-term use in malicious campaigns. The absence of detections and minimal blocklist presence highlights the need for heightened user vigilance and proactive threat intelligence sharing. The current status of this domain remains active, and it is actively leveraged in phishing lures targeting DHL customers. Users are strongly advised to avoid clicking links from unexpected shipping notifications, verify sender domains independently, and report suspicious communications to DHL’s official fraud channels. Organizations should consider blocking this domain and IP address at the network perimeter to mitigate risk exposure.