dhxexpressservices[.]org

Analysis of dhxexpressservices.org shows a newly created (30 Sep 2025) domain registered through Dynadot LLC that is currently active and serving HTTP 200 responses. The site presents a TLS certificate from Let’s Encrypt (E7) and resolves to IP 198.23.193.170, which belongs to a US‑based hosting provider (AS36352 HostPapa). Infrastructure details include LiteSpeed web server, jQuery, and HTTP/3 support; the domain uses four nameservers (dns1.geebytesdns.com, dns2.geebytesdns.com, ns1.geebytescloud.com, ns2.geebytesclou). The page title returned is "DHL Service Express", and the domain is classified as a brand‑impersonation campaign targeting the brand "celer". Security‑engineered scores are low: Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 4 of 95 scanners flagging the domain. The domain is already listed on at least one blocklist and has been blocked by PhishDestroy. Evidence of malicious intent is limited to the brand‑impersonation label and low trust scores; the exact payload or credential‑harvesting mechanisms have not been observed. Defenders should immediately block DNS resolution and HTTP traffic to 198.23.193.170, add the domain to URL filtering and email security policies, and consider sinkholing the IP range. Continuous monitoring for any changes in content or additional detection signatures is recommended, as further malicious activity may emerge.