dhl[.]servirtual[.]cl

This domain, dhl.servirtual.cl, poses a brand impersonation threat specifically targeting DHL customers through fraudulent notification pages. The site displays a fabricated message count ('1 nuevo mensaje') to lure recipients into entering sensitive credentials or downloading malicious payloads, commonly associated with credential harvesting or malware distribution campaigns. The infrastructure mimics legitimate logistics tracking portals to exploit user trust in the DHL brand, increasing the likelihood of successful compromise. Analysis indicates the domain was registered on October 16, 2014, through NIC Chile, though the malicious activity appears to be a recent repurposing of existing infrastructure. The domain resolves to IP address 52.27.138.176 (AS16509, Amazon.com, Inc.) and is flagged by 18 out of 95 security vendors on VirusTotal. It appears on two distinct security blocklists (PhishDestroy and PhishingDB) and uses a Let's Encrypt SSL certificate (R12), which while valid, provides no inherent trustworthiness for the content served. The page title '1 nuevo mensaje' serves as a clear technical indicator of the fraudulent notification tactic employed. Users who visited dhl.servirtual.cl should immediately revoke any credentials entered on the site and scan their systems for malware using updated security tools. Network administrators should block the domain and its resolving IP (52.27.138.176) at the perimeter, while monitoring for connections to this infrastructure. Affected individuals should check for unauthorized transactions or account modifications, particularly in systems where DHL-related services are used. The domain's current offline status does not eliminate risk, as the infrastructure may be reactivated or repurposed for future campaigns.