Phishing Analysis
Detailed analysis of captured phishing page
65
Risk Score
Medium Risk
Threat Level: CRITICAL
• Impersonating: DPD
- • Threat: Package tracking phishing aimed at harvesting tracking numbers.
- • Target: DPD customers internationally.
- • Method: Fake DPD tracking page used to collect package tracking number.
- • Exfil: Unknown, likely to a database controlled by the attacker.
- • Indicators: IP address as domain, domain mismatch.
- • Risk: HIGH - Potential for further malicious activity targeting users who enter their tracking numbers.
⚠ Risk Factors
- Brand impersonation of DPD on non-official domain
- Credential harvesting indicators detected
- Banking fraud indicators detected
Visual Capture
Detection Info
https://194-164-61-191.cprapid.com/de
Detected Brand
DPD
Country
International
Confidence
100%
HTTP Status
200
Report ID
9ea3d8b0-001…
Analyzed
2025-12-26 07:48
Final URL (after redirects)
https://194-164-61-191.cprapid.com/de/update.php?87ingzzxd5avf50kdg5y
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T174B2017094B5B63F009F7391A7386709A3D39783CB520BE567F8936D4B8AE84DC23169 |
|
CONTENT
ssdeep
|
192:BixLoxwz77qKHv/ySchJrVUmZGkozXTCReWyRMOsUFf9kIT/JO:Ax8xw7pvKpJrVUIGk8+TxFUH/JO |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bcc3c33c83693cc3 |
|
VISUAL
aHash
|
ffffffc3df8181ff |
|
VISUAL
dHash
|
390000272d2b0342 |
|
VISUAL
wHash
|
8dffff81818181a9 |
Code Analysis
Risk Score
65/100
Threat Level
CRITICAL
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🔬 Threat Analysis Report
• Threat: Package tracking phishing aimed at harvesting tracking numbers.
• Target: DPD customers internationally.
• Method: Fake DPD tracking page used to collect package tracking number.
• Exfil: Unknown, likely to a database controlled by the attacker.
• Indicators: IP address as domain, domain mismatch.
• Risk: HIGH - Potential for further malicious activity targeting users who enter their tracking numbers.
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
DPD
https://212-227-48-175.cprapid.com/de/update.php
Jan 07, 2026
No screenshot
DPD
https://138-68-183-9.cprapid.com/de/update.php
Dec 31, 2025
DPD
https://138-68-183-9.cprapid.com/de/update.php
Dec 31, 2025
DPD
https://217-160-164-192.cprapid.com/de/update.php?g1hdiel1pc...
Dec 30, 2025
DPD
https://69-164-193-72.cprapid.com/de/update.php
Dec 30, 2025
Scan History for 194-164-61-191.cprapid.com
Found 6 other scans for this domain