dhll[.]us[.]cc

Analysis identifies dhll.us.cc as a delivery_scam infrastructure impersonating DHL logistics services. The domain is currently reported as offline, indicating disruption of active malicious hosting; however historical telemetry confirms its use in fraudulent delivery notification campaigns designed to harvest user information or redirect to secondary payload infrastructure.

Infrastructure analysis shows the domain resolves to IP 124.156.241.125 and was registered through Gname.com Pte. Ltd., with creation date June 12, 2026. Security telemetry indicates it was flagged by 8 of 95 VirusTotal vendors and appears on 1 security blocklist, while PhishDestroy has actively blocked the domain. The combination of a recently created registration, minimal trust history, and rapid detection by multiple engines suggests a short-lived but targeted phishing operation.

At present, dhll.us.cc is marked offline, reducing immediate exposure risk; however residual risks remain due to cached DNS records, potential mirror domains, and reused infrastructure. Recommended mitigations include continued domain-level blocking, retrospective email and proxy log review for connections to 124.156.241.125, and enrichment of threat intelligence feeds with the domain and IP indicators. Organizations should also monitor for typographical variants of DHL branding domains and enforce delivery-notification verification procedures to prevent user interaction with spoofed logistics prompts.