Scammers are most likely to impersonate DHL; DHL related to 22% of all phishing attacks globally in Q3, followed by Microsoft, LinkedIn, Google, Netflix, WeTransfer, Walmart, WhatsApp, HSBC and Instagram: Check Point Research report

Sample article from our Housing & Economy

October 25, 2022 (press release) –

(GlobeNewswire) - Check Point Research (CPR), the Threat Intelligence arm of Check Point Software Technologies Ltd. (NASDAQ: CHKP), a leading provider of cybersecurity solutions globally, has published its Brand Phishing Report for Q3 2022. The report highlights the brands which were most frequently imitated by criminals in their attempts to steal individuals personal information or payment credentials during July, August and September.

While LinkedIn was the most imitated brand in both Q1 and Q2 2022, its shipping company DHL that took the top spot in Q3, accounting for twenty-two percent of all phishing attempts worldwide. Microsoft is in second place (16%) and LinkedIn has fallen into third, making up just 11% of scams, compared to 52% in Q1 and 45% in Q2. DHLs increase could be due in part to a major global scam and phishing attack that the logistics giant warned about itself just days before the quarter started. Instagram has also appeared in the top ten list for the first time this quarter, following a blue-badge related phishing campaign that was reported in September.

Shipping is one of the top industry sectors for brand phishing, second only to technology. As we head into the busiest retail period of the year, CPR will continue to monitor shipping related scams as threat actors will likely increase their efforts to take advantage of online shoppers.

Phishing is the most common type of social engineering, which is a general term describing attempts to manipulate or trick users. It is an increasingly common threat vector used in most security incidents, commented Omer Dembinsky , Data Research Group Manager at Check Point. In Q3, we saw a dramatic reduction in the number of phishing attempts related to LinkedIn, which reminds us that cybercriminals will often switch their tactics to increase their chances of success. It is still the third most commonly impersonated brand though, so wed urge all users to stay mindful of any emails or communications purporting to be from LinkedIn. Now that DHL is the brand most likely to be imitated, its crucial that anyone expecting a delivery goes straight to the official website to check progress and/or notifications. Do not trust any emails, particularly those asking for information to be shared.

In a brand phishing attack, criminals try to imitate the official website of a well-known brand by using a similar domain name or URL and web-page design to the genuine site. The link to the fake website can be sent to targeted individuals by email or text message, a user can be redirected during web browsing, or it may be triggered from a fraudulent mobile application. The fake website often contains a form intended to steal users credentials, payment details or other personal information.

Top phishing brands in Q3 2022

Below are the top brands ranked by their overall appearance in brand phishing attempts: DHL (related to 22% of all phishing attacks globally)Microsoft (16%)LinkedIn (11%)Google (6%)Netflix (5%)WeTransfer (5%)Walmart (5%) WhatsApp (4%) HSBC (4%)Instagram (3%)

DHL Phishing Email Account Theft Example

As part of campaigns using DHLs branding that appeared during Q3 2022, we observed a malicious phishing email that was sent from a webmail address info@lincssourcing[.]com and spoofed to appear as if it was sent from DHL Express. The email contained the subject- Undelivered DHL(Parcel/Shipment), and the content tries to persuade the victim to click on a malicious link claiming that there is a delivery intended for them that can be sent just after updating the delivery address. This link leads to a malicious website- https://bafybeig4warxkemgy6mdzooxeeuglstk6idtz5dinm7yayeazximd3azai[.]ipfs[.]w3s[.]link/dshby[.]html/ that requires the victims username and password to be entered.

OneDrive Phishing Email Account Theft Example

In this phishing email, we see an attempt to steal a users Microsoft account information. The email which was sent from the webmail address under the fake sender name - OneDrive, contained the subject A document titled Proposal has been shared with you on Onedrive. The attacker tries to lure the victim to click on the malicious link claiming that an important document titled Proposal shared with them on their OneDrive. This malicious link https://mail-supp-365[.]herokuapp[.]com/ redirects the user to a fraudulent Microsoft web app login page, there the user needs to enter their account password.

As always, we encourage users to be cautious when divulging personal data and credentials to business applications or websites, and to think twice before opening email attachments or links, especially emails that claim to be from companies such as DHL, Microsoft or LinkedIn, as they are the most likely to be impersonated.

Follow Check Point Research via:



About Check Point Research

Check Point Research provides leading cyber threat intelligence to Check Point Software customers and the greater intelligence community. The research team collects and analyzes global cyber-attack data stored on ThreatCloud to keep hackers at bay, while ensuring all Check Point products are updated with the latest protections. The research team consists of over 100 analysts and researchers cooperating with other security vendors, law enforcement and various CERTs.

About Check Point Software Technologies Ltd.

Check Point Software Technologies Ltd. ( is a leading provider of cybersecurity solutions to corporate enterprises and governments globally. Check Point Infinitys portfolio of solutions protects enterprises and public organisations from 5th generation cyberattacks with an industry leading catch rate of malware, ransomware and other threats. Infinity comprises four core pillars delivering uncompromised security and generation V threat prevention across enterprise environments: Check Point Harmony, for remote users; Check Point CloudGuard, to automatically secure clouds; and Check Point Quantum, to protect network perimeters and datacenters, all controlled by the industrys most comprehensive, intuitive unified security management; Check Point Horizon, a prevention-first security operations suite. Check Point protects over 100,000 organizations of all sizes. MEDIA CONTACT:INVESTOR CONTACT:

Emilie Beneitez LefebvreKip E. Meintzer

Check Point Software TechnologiesCheck Point Software Technologies

* All content is copyrighted by Industry Intelligence, or the original respective author or source. You may not recirculate, redistrubte or publish the analysis and presentation included in the service without Industry Intelligence's prior written consent. Please review our terms of use.

See our dashboard in action - schedule an demo
Jason Irving
Jason Irving
- SVP Enterprise Solutions -

We offer built-to-order housing & economy coverage for our clients. Contact us for a free consultation.

About Us

We deliver market news & information relevant to your business.

We monitor all your market drivers.

We aggregate, curate, filter and map your specific needs.

We deliver the right information to the right person at the right time.

Our Contacts

1990 S Bundy Dr. Suite #380,
Los Angeles, CA 90025

+1 (310) 553 0008

About Cookies On This Site

We collect data, including through use of cookies and similar technology ("cookies") that enchance the online experience. By clicking "I agree", you agree to our cookies, agree to bound by our Terms of Use, and acknowledge our Privacy Policy. For more information on our data practices and how to exercise your privacy rights, please see our Privacy Policy.