A short electronic message (SMS) is being distributed to phone numbers with a Kosovo prefix, claiming to be from "DHL Express" mail.
Message content:
“DHL Express: Hello! Your DHL package has arrived at the sorting center and we are currently requesting your address information to ensure successful delivery. Please click on the link below to verify and update your shipping address: https://dhl.kosoves.im/help. After updating the information, the system will automatically arrange the subsequent delivery; no further action is required from you. Thank you for using DHL Express. https://dhl.kosoves.im/help"
What makes this SMS suspicious?
The message is received from a private email and not from any postal official.
Also, if the link presented in the content is opened, it leads directly to a space to fill in personal data, which then leads to a space to make a payment.
Verifications:
Initially, the email from which the SMS was received is curtpaulmiller@gmail.com. While on the official Facebook page of DHL mail in Kosovo, the e-mail address “info@3plog.net” appears. (see here)
If the link provided in the SMS is clicked, a page appears that “warns” the user that the shipment was not delivered due to an incomplete or incorrect address. It also states that the package is left at the “DHL Express” center in Kosovo and that some information must be filled in to organize a new shipment.
It should be noted here that no buttons are clickable and that only the spaces for filling in the data are accessible.
Clicking to continue leads to the link to update the data for the claimed shipment. Filling them out (hibrid.info has done it with a fictitious name and unrealistic data)
The site accepts the data and after clicking the "continue" button, a new page appears, requesting funds.
The deceptive method of obtaining personal or financial information by posing as a trusted source, usually through emails, messages or fake websites, is known as “Phishing” (see here).
The fraudulent website in this SMS is “https://dhl.kosoves.im/help”. While the official DHL mail website in Kosovo is “mydhl.express.dhl/kv".
Even the website verification platform "Scamdoc.com"has described this website as suspicious."
On March 16, the page "DHL Kosovo" on Facebook has called for caution against fraudulent messages circulating on behalf of the "DHL Express" mail service.
Hibrid.info has also dealt with such fraudulent SMS in the past on behalf of this post. (see here).
Analyze:
A fraudulent SMS is being sent to numbers with a Kosovo prefix. The message claims to be about an order from DHL Express in Kosovo, falsely informing them of a “package” that cannot be delivered due to an incomplete address and inviting them to click on a link to update the data.
After verification by hibrid.info, it was confirmed that the message (SMS) was not sent by DHL, but by a private email, while the link included in it is fraudulent. This website has been classified as suspicious by the website verification platform, and the steps that hibrid.info followed to analyze it warn of a “phishing” risk.
Based on its work methodology, hibrid.info assesses this content (SMS) as "Fraud".
Reasoning:
The “Deception” rating is given to informational content that is manipulated in terms of visual (deepfake, cheapfake), audio, or textual content to deceive the audience. This form of deception is usually used to produce false and manipulated content.