Phishing detection: dhlexpress.bg

DHL
http://dhlexpress.bg/en/shipping-advice/packaging Access site
Screenshot
Screenshot of dhlexpress.bg
Investigate
Domain dhlexpress.bg2 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 81.95.110.236
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://dhlexpress.bg/en/shipping-advice/packaging
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
26 low suspicionheuristic risk score · not a probability
Keyword matchBrand impersonation in pathOpenPhish
17 signals fired · detector v2.0.0
AI analysis AIBeta
Delivery scam

Site impersonates DHL Express using a lookalike .bg domain served from Czech infrastructure. It replicates the DHL favicon and presents a form to capture victim data, consistent with a delivery-themed phishing operation. Flagged by OpenPhish.

Brand impersonation in pathOpenPhishBrand favicon
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-27 · confidence 80%
Domain & Network
Whois
Network
IP 81.95.110.236
Country CzechiaCzechia
Hosting ACTIVE 24, s.r.o.
ASN AS25234
TLS Cert -
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-27 13:02 UTC  ·  Last refreshed 2026-07-29 13:30 UTC