Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.
Checkpoint research revealed that DHL was the most-phished brand in 2021,1 which led us to wonder if the same will hold for 2022. We scoured the Web for domains and subdomains containing “dhl” and subjected these to further scrutiny to identify more connected artifacts.
Our analysis allowed us to build detailed threat research materials that revealed:
- Thousands of domains and subdomains containing the string “dhl” were registered between 1 January and 31 December 2021, but only a handful were owned by the company.
- Hundreds of the more than 15,000 web properties with the courier’s name were dubbed “dangerous” by various malware engines.
- More DHL-containing domains and subdomains have already been registered this month compared to the 2021 monthly average. Should this trend hold, the company may again be in the running for 2022’s most-phished brand.
Download the threat research materials now to access the complete list of identified artifacts used to conduct additional enrichment and threat analysis as well as trend identification.
—
- [1] https://techwireasia.com/2022/01/dhl-most-imitated-brand-in-phishing-scams/