Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://track-dhl-delivery.duckdns.org/
Detected Brand
DHL
Country
International
Confidence
96%
HTTP Status
N/A
Report ID
4ec2caa7-ceb…
Analyzed
2026-03-05 12:30
Final URL (after redirects)
https://track-dhl-delivery.duckdns.org/track/track.php
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1884158B443A3D92B44B2D2C9B6B91B5B63C0829CCAE3161163EDC39D0FEEC55FC52140 |
|
CONTENT
ssdeep
|
24:hR/CH4mOLohuxBVLxnjz5EB8p0KKohzohun/ipmHp:T24myoa3LNe8p0ytp |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b673591c1c535d1c |
|
VISUAL
aHash
|
00e7e7e7dfffffff |
|
VISUAL
dHash
|
2a0c4e0c36240000 |
|
VISUAL
wHash
|
00c3e7e7001b0f0f |
|
VISUAL
colorHash
|
07000038000 |
|
VISUAL
cropResistant
|
2a0c4e0c36240000 |
Code Analysis
Risk Score
81/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
Telegram Exfiltration
🔬 Threat Analysis Report
• Threat: Phishing
• Target: DHL customers
• Method: Impersonation and payment request
• Exfil: Telegram Bot
• Indicators: Suspicious domain, payment request, obfuscation.
• Risk: High
🔒 Obfuscation Detected
- fromCharCode
- js_packer
📡 API Calls Detected
- https://ipwho.is/
🔑 Telegram Bot Tokens (1)
- 8519633985:AAF3...Xkas8_QM
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not the official DHL domain and uses a free domain.
Requests for payment
The page prompts the user to add payment and continue.
Obfuscation Detected
The presence of obfuscation further suggests malicious intent, likely to hide malicious code.
Form Detected
Presence of a form suggests intent to collect data
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
DHL users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Telegram Bot (8519633985:AAF3Nyhy5...)
Risk Assessment
CRITICAL - Automated credential harvesting with Telegram Bot (8519633985:AAF3Nyhy5...)
⚠️ Indicators of Compromise
- 1 Telegram bot token(s)
- Kit types: Credential Harvester
- 105 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
DHL
Official Website
dhl.com
Fake Service
DHL delivery attempt
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Impersonation
The attackers are impersonating DHL to trick users into providing payment information. The website mimics DHL's branding to appear legitimate.
Secondary Method: Social Engineering
The scam uses urgency (delivery attempt failed) to pressure the user into providing their payment details.
📡 Telegram Command & Control Infrastructure
Bot Token (Masked)
8519633985:AAF3...Xkas8_QM
Bot ID
8519633985
Group/Chat ID
Unknown
Operator Language
Unknown
💬 Message Templates (3)
| ID | Portuguese | English | Trigger |
|---|---|---|---|
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
track-dhl-delivery.duckdns.org
Registered
None
Registrar
None
Status
Inactive
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
DHL
https://inuclo.com/wp-content/uploads/2026/ini2/DHLnew/?toke...
Apr 14, 2026
DHL
https://inuclo.com/wp-content/uploads/2026/ini2/DHLnew/track...
Apr 14, 2026
DHL
http://pku.fgr.mybluehost.me/e/DHL/track/track.php
Mar 23, 2026
DHL
https://nlb.bbn.mybluehost.me/Multi/2K25-MultiLang/track/tra...
Mar 08, 2026
DHL
https://nlb.bbn.mybluehost.me/Multi/2K25-MultiLang/track/tra...
Mar 06, 2026
Scan History for track-dhl-delivery.duckdns.org
Found 4 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.