DHL

Postal & parcel Germanydhl.comRank 8 of the most impersonated
Cert findings · 24 h
2
Cert findings · 7 days
6
3 reported or listed · 2 on phishing hosts · 1 on Spamhaus DROP
Registered lookalikes
62
1 listed by a source or an address list
Official domains
106
verified from DHL's own sites and records

Certificate findings for DHL

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to DHL's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 10 findings, grouped by hostname

  1. dhl.nl.qas-benelux.edistrada.pl PL · AS20889 · A41-AS All for One Poland S…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 15 y ago
    DetailsHide
    Hostname
    dhl.nl.qas-benelux.edistrada.pl
    First seen
    2026-11-04 12:20 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.206.38.164.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 91.206.38.164
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 11:11 UTC to 2027-02-02 11:11 UTC
    Logged 2026-11-04 12:09 UTC in Google ParcelYard2027h1, entry 608,057,489
    SHA-256 1510099202e5255ad1328b806108beef6f4616d9c205da71188708a1c66b6d43
    Public key SHA-256 a6e9f713fb6aab10b5fbd0353cd2d7ecf740cc6d2c4daff62cb217bf9bda33b5
    Brand
    DHL
    Addresses
    91.206.38.164 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    91.206.38.179 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    Domain
    edistrada.pl
    Registered
    2011-09-15 · OVH SAS
    MX
    Receives mail at mail.edistrada.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 13:11 UTC

    Suggest a correction

  2. dhl.pl.qas.edistrada.pl PL · AS20889 · A41-AS All for One Poland S…2 addresses
    ReportedReported by PhishDestroyMX presentSPF -allDMARC rejectRegistered 15 y ago
    DetailsHide
    Hostname
    dhl.pl.qas.edistrada.pl
    First seen
    2026-11-04 12:10 UTC
    First published
    2026-11-04 13:12 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 11:11 UTC to 2027-02-02 11:11 UTC
    Logged 2026-11-04 12:09 UTC in Google PlumbersArms2027h1, entry 608,482,977
    SHA-256 b27e97a2bb94223b5fcd443270eb004226dc3b4f6288a6a988eded4d5f88cc8c
    Public key SHA-256 e168712724da5a4d56485a9110718bb562e0cff830fe470e3e2c7f2ae53c6e4e
    PhishDestroy
    Brand
    DHL
    Addresses
    91.206.38.164 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    91.206.38.179 · Poland · AS20889 A41-AS All for One Poland Sp. z o.o.
    Domain
    edistrada.pl
    Registered
    2011-09-15 · OVH SAS
    MX
    Receives mail at mail.edistrada.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 13:11 UTC

    Suggest a correction

  3. iedhl-trackexpress.com 101.1.16.8
    ReportedReported by PhishTank as imitating DHLMX absentSPF missingDMARC missingRegistered 6 d ago
    DetailsHide
    Hostname
    iedhl-trackexpress.com
    First seen
    2026-11-03 21:35 UTC
    First published
    2026-11-03 21:49 UTC
    Listing
    PhishTank: first observed in the feed 2026-11-03 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Not resolving · checked 2026-11-05 06:06 UTC
    Reported
    PhishTank
    1. Certificate logged in CT
    2. Observed in the PhishTank feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 10:29 UTC to 2027-02-01 10:29 UTC
    Logged 2026-11-03 11:27 UTC in Let's Encrypt Willow2027h1, entry 912,589,314
    SHA-256 ba2435faff0274fc1caa306b0094c0778b7f6bd118e9b0d1ceb2856f3d0c2e17
    Public key SHA-256 a6fa1bf753d4f0f98fa082511e7e30dc830a7932123c846cd620a6b077dd3806
    PhishTank
    PhishTank report #9554244
    Brand
    DHL
    Addresses
    101.1.16.8
    Domain
    iedhl-trackexpress.com
    Registered
    2026-10-30 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 21:48 UTC

    Suggest a correction

  4. dhl-limited-help.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    dhl-limited-help.wasmer.app
    First seen
    2026-11-03 16:37 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 15:35 UTC to 2027-02-01 15:35 UTC
    Logged 2026-11-03 16:33 UTC in IPng Networks Halloumi2027h1, entry 350,736,709
    SHA-256 015ef328ebe1b219d42d19757500ad89eb87fc75205538d0458b2312d5111a24
    Public key SHA-256 b8e6fa374f4091a8f6e8dce82b2ce59f41787bb1a45a2d78740d49cbffc71324
    Brand
    DHL
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  5. qa.livraison-dhl-france.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under livraison-dhl-france.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    qa.livraison-dhl-france.com
    First seen
    2026-11-03 14:57 UTC
    First published
    2026-11-03 15:38 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Reported
    PhishDestroy, listing livraison-dhl-france.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 13:53 UTC to 2027-02-01 13:53 UTC
    Logged 2026-11-03 14:52 UTC in IPng Networks Halloumi2027h1, entry 349,822,970
    SHA-256 4b479b2a343f4937e5e1b76bb6160d1bac43d21339aa1af198aca219203bc024
    Public key SHA-256 dd3ccfd3df5be852edb8825021937fcfe9cdf78b52853b0f67afd5661c396ff0
    PhishDestroy
    Brand
    DHL
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    livraison-dhl-france.com
    Registered
    2026-02-18 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  6. dhl-france-track.com DE · AS210558 · services-1337-gmbh 1337 Ser…
    Spamhaus DROPAddress listed by Spamhaus DROPMX presentSPF ~allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    dhl-france-track.com
    First seen
    2026-11-01 18:11 UTC
    First published
    2026-11-01 19:10 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 45.94.31.121.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.94.31.121
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-01 17:05 UTC to 2027-01-30 18:04 UTC
    Logged 2026-11-01 18:05 UTC in Geomys Tuscolo2027h1, entry 435,258,818
    SHA-256 8b0806fc491728a74511d222c6bfef4cf75b68aa526e91e5e860e118b676e0d3
    Public key SHA-256 b36c85732953f412c3be5fe8dacc32999c7bef9426cc8b34cb7b6169c025dc19
    Brand
    DHL
    Addresses
    45.94.31.121 · Germany · AS210558 services-1337-gmbh 1337 Services GmbH
    Domain
    dhl-france-track.com
    Registered
    2023-12-02 · Squarespace Domains II LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  7. dhll-dellvred.com US · AS205397 · AS-69HOST 69HOST LLC
    ReportedReported by PhishTank as imitating DHLMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    dhll-dellvred.com
    First seen
    2026-10-29 07:26 UTC
    First published
    2026-10-29 07:46 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Not resolving since 2026-11-04 · checked 2026-11-05 07:51 UTC
    Reported
    PhishTank
    1. Certificate logged in CT
    2. Observed in the PhishTank feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-29 01:14 UTC to 2027-01-27 01:14 UTC
    Logged 2026-10-29 02:12 UTC in IPng Networks Halloumi2027h1, entry 295,632,165
    SHA-256 783b219f081a58742234704df78a8f0a6a49aec8307d2c7b01733e7a9bcd8a9d
    Public key SHA-256 679f20db6ce6709e6e45028702bb67faad2af56d1042f3bdc6c78723d7a0457d
    PhishTank
    PhishTank report #9552027
    Brand
    DHL
    Addresses
    45.74.61.10 · United States · AS205397 AS-69HOST 69HOST LLC
    Domain
    dhll-dellvred.com
    Registered
    2026-10-29 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:44 UTC

    Suggest a correction

  8. vpn2.livraison-dhl-france.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under livraison-dhl-france.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 mo ago
    DetailsHide
    Hostname
    vpn2.livraison-dhl-france.com
    First seen
    2026-10-28 17:00 UTC
    First published
    2026-10-28 17:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 17:30 UTC
    Reported
    PhishDestroy, listing livraison-dhl-france.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-28 16:00 UTC to 2027-01-26 16:00 UTC
    Logged 2026-10-28 16:58 UTC in Let's Encrypt Sycamore2027h1, entry 823,789,748
    SHA-256 0e47029abc2f827ffc473a7d9be2f30386c7d8e74ba029d14645bc4ad138ba07
    Public key SHA-256 dd3ccfd3df5be852edb8825021937fcfe9cdf78b52853b0f67afd5661c396ff0
    PhishDestroy
    Brand
    DHL
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    livraison-dhl-france.com
    Registered
    2026-02-18 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  9. dhl.id-express-com.top UA · AS200000 · Ukraine-AS Hosting Ukraine …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    dhl.id-express-com.top
    First seen
    2026-10-28 09:16 UTC
    First published
    2026-10-28 10:00 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.68.16.34.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.68.16.34
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-28 08:11 UTC to 2027-01-26 08:11 UTC
    Logged 2026-10-28 09:10 UTC in DigiCert Wyvern2027h1, entry 331,956,298
    SHA-256 3b6faebab0a9d24fa72d98d8ae7a4299bc4862f0c2ea282b3acb3f6231b6dc12
    Public key SHA-256 901baea7700ea7aa63dc51269c31d3b263d4a980f51d673927b63303fadc6d31
    Brand
    DHL
    Addresses
    185.68.16.34 · Ukraine · AS200000 Ukraine-AS Hosting Ukraine LTD
    Domain
    id-express-com.top
    Registered
    2026-10-28 · PDR Ltd.
    MX
    Receives mail at mx.services
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  10. account-dhl.pl PL · AS29522 · CF-KRK Cyber_Folks S.A.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    account-dhl.pl
    First seen
    2026-10-27 09:00 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 94.152.11.118.
    1. Phishing-host list fetched with the address
    2. Resolved to 94.152.11.118
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 320,858,639
    SHA-256 8215aa5f50442def7f291fae46aed2bfb76802a444242f9fd36cabc5df6573ec
    Brand
    DHL
    Addresses
    94.152.11.118 · Poland · AS29522 CF-KRK Cyber_Folks S.A.
    Domain
    account-dhl.pl
    Registered
    2023-12-15 · cyber_Folks S.A.
    MX
    Receives mail at account-dhl.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:31 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches DHL when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Postal & parcel

All brands →