A review of the DHL-themed phishing flow on `uzertaw[.]store`, including the redirect chain, fake billing step, and the social-engineering tactics it uses to coax users into handing over personal and payment data.
April 4, 20265 min read
Author
Writing about phishing detection, safer links, and practical product security.
Tim Leland has over 20 years of experience building safer link experiences across Link Shield and T.LY, with a focus on phishing prevention, URL risk scoring, and developer-friendly security tooling.
A review of the DHL-themed phishing flow on `uzertaw[.]store`, including the redirect chain, fake billing step, and the social-engineering tactics it uses to coax users into handing over personal and payment data.
A review of the phishing URL `gixon.sbs/_wildcard_.gixon.sbs/views/`, from the brand mismatch to the mailbox-login flow and the wildcard routing clues in the path.
Wildcard routing and fast domain churn let one phishing kit keep showing up under new hostnames. That is why exact-match blocking keeps falling behind.
Static blocklists usually score the first URL and stop. That is exactly why attackers hide the real destination deeper in the redirect chain.
Bad actors do not just abuse links. They also abuse the systems meant to report them. Here is how spam-report floods get manufactured and what defenders should score instead of raw report volume.