EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of dpdhelp4.one

Detection Info

https://dpdhelp4.one
Detected Brand
DPD
Country
International
Confidence
100%
HTTP Status
200
Report ID
59caa747-1e0…
Analyzed
2026-03-18 04:30
Final URL (after redirects)
https://dpdhelp4.one/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1AB139973E084793F4197C2C1B72CBB4ED393418EC96A559163FC83595FCAE52D412A27
CONTENT ssdeep
384:NVVp0Ujw0zqp5RizgF/PuSSJHwJJSSrhb3:NVH0Ujw0qpSeHLiwJQo3

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
f5cb9238ca74ab24
VISUAL aHash
ffe2e2f0c0c2c2ff
VISUAL dHash
1654464626061626
VISUAL wHash
ffe2e2e080c2c2f6
VISUAL colorHash
06480001000
VISUAL cropResistant
1654464626061626,f0e0809250642703,0e12151505090929,311111c9c9092b65

Code Analysis

Risk Score 94/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info
WebSocket C2

🔬 Threat Analysis Report

• Threat: Credential Phishing
• Target: DPD users
• Method: Impersonation via suspicious domain with form.
• Exfil: Potentially via websocket.
• Indicators: Domain age, obfuscation, form actions to legitimate DPD, JavaScript form submissions.
• Risk: HIGH

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode
  • unescape
  • base64_strings

🎯 Kit Endpoints

  • https://www.dpd.com/de/de/versenden/reifenversand/
  • resend
  • https://www.dpd.com/de/de/versenden/
  • https://my.dpd.de/sending/sendparcel.aspx
  • https://www.dpd.com/de/de/logistikpartner-nahverkehr-werden/
  • https://www.dpd.com/de/de/empfangen/sendungsverfolgung-und-live-tracking/
  • /k180_de_post_dpd_index/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.11.5
  • https://www.dpd.com/de/de/versenden/angebot-fuer-geschaeftskunden/
  • https://www.dpd.com/de/de/versenden/expressversand/
  • https://www.dpd.com/de/de/logistikpartner/
  • https://www.dpd.com/de/de/versenden/palettenversand/
  • https://www.dpd.com/de/de/logistikpartner-im-fernverkehr/
  • https://www.dpd.com/de/de/versenden/briefversand-geschaeftspost-versenden/
  • https://www.dpd.com/de/de/versenden/preise/
  • https://www.dpd.com/de/de/versenden/lebensmittelversand-dpd-food/
  • https://www.dpd.com/de/de/versenden/paketversand/
  • https://www.dpd.com/de/de/versenden/e-commerce-versand/
  • https://www.dpd.com/de/de/versenden/internationaler-versand/

📤 Form Action Targets

  • https://www.dpd.com/de/de/

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Recent Domain
The domain is only a few days old.
Domain Mismatch
The domain does not belong to the brand.
Obfuscation
Code is obfuscated, suggesting malicious intent.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
DPD users (International)
Attack Method
Brand impersonation + credential harvesting forms + real-time WebSocket exfiltration + obfuscated JavaScript
Exfiltration Channel
WebSocket (1 endpoints) + HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with WebSocket (1 endpoints) + HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 5 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
DPD
Official Website
dpd.com
Fake Service
Shipping services

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site attempts to steal DPD login credentials by impersonating the brand, likely using the forms with obfuscated javascript. Submitting to the correct URL might be a way to avoid getting caught early. Forms probably collect credentials that will be used to access user accounts.

Secondary Method: Websocket for Potential Exfiltration

WebSocket URL detected may be used for real-time monitoring of user activity or data exfiltration.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
dpdhelp4.one
Registered
2024-03-12
Registrar
Unknown
Status
ACTIVE

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
DPD
http://dpd-atchecke.eu.cc/at/
Apr 03, 2026
😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.