# PhishDestroy domain threat record: dhl-tracking.live

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dhl-tracking.live/
Machine-readable companion: https://phishdestroy.io/domain/dhl-tracking.live/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:21:34 UTC
- Last availability or vendor check: 2026-10-25 16:38:57 UTC
- Stored record updated: 2026-10-25 23:22:20 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: OpenPhish, Phishunt
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: DHL

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a173ec-8d75-7079-b9d3-6d7eafedec2b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dhl-tracking.live
- Certificate Transparency search: https://crt.sh/?q=%25.dhl-tracking.live
- Web Archive lookup: https://web.archive.org/web/*/https://dhl-tracking.live/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed dhl-tracking.live as a suspicious domain. The recorded page title was “DHL Seguimiento — ¿Dónde está mi paquete?”. The domain first appeared in PhishDestroy’s intake on 2026-10-25, and an HTTP 200 response was recorded on that date.

How the scam works
The page presented a DHL‑branded tracking interface, a common lure for harvesting shipment numbers or login credentials. Such impersonations typically aim to trick users into providing personal data that can be used for credential theft or further social‑engineering attacks.

Evidence
Google Safe Browsing flagged the URL for social engineering on 2026-10-25. urlscan.io captured the site on 2026-10-25 and returned a malicious phishing verdict with a score of 100, identifying DHL as the impersonated brand. OpenPhish and Phishunt both listed the domain as malicious as of the same date. OTX recorded one pulse referencing the domain on 2026-10-25. PhishDestroy’s internal blocklist marked the domain as true. VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported zero detections.

Infrastructure
The domain was registered on 2026-10-24 through Hosting Concepts B.V. d/b/a Registrar.eu. TLS was provided by Let’s Encrypt, valid from 2026-10-24 to 2027-01-22, covering *.dhl-tracking.live. The recorded IP addresses included 172.67.139.126 and 104.21.26.227, both belonging to the CloudFLARENET‑EU network in GB. No DNSSEC records were observed.

What to do
Visitors should not enter DHL credentials, tracking numbers, or personal data on this site and should delete any information already submitted. Monitor any DHL account for unauthorized activity and report the domain to DHL’s abuse team. Network defenders can block dhl-tracking.live at firewalls or proxies and review logs for connections to the recorded IPs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17326-ce00-74b3-8746-ff6a4d5a5cc7/
Cloudflare Radar report: https://radar.cloudflare.com/scan/bdc2a691-371e-4396-bba4-699a49b61196
Stored capture screenshot: https://urlscan.io/screenshots/01a17326-ce00-74b3-8746-ff6a4d5a5cc7.png
Cloudflare Radar screenshot (2026-10-25T16:26:58Z): https://screenshots.phishdestroy.io/cf/bdc2a691-371e-4396-bba4-699a49b61196.png
VirusTotal report: https://www.virustotal.com/gui/domain/dhl-tracking.live
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dhl-tracking.live
Archived copy: https://web.archive.org/web/20261025162334/https://dhl-tracking.live/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 16:31:10 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/cXh8PzQX/f3492e845ad6.png
  Captured: 2026-10-25 16:38:57 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a173ec-8d75-7079-b9d3-6d7eafedec2b.png
  Captured: 2026-10-25 16:38:57 UTC
  Source report: https://urlscan.io/result/01a173ec-8d75-7079-b9d3-6d7eafedec2b/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a17326-ce00-74b3-8746-ff6a4d5a5cc7.png
  Captured: 2026-10-25 16:21:34 UTC
  Source report: https://urlscan.io/result/01a173ec-8d75-7079-b9d3-6d7eafedec2b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bdc2a691-371e-4396-bba4-699a49b61196.png
  Captured: 2026-10-25 16:26:58 UTC
  Source report: https://radar.cloudflare.com/scan/bdc2a691-371e-4396-bba4-699a49b61196
  SHA-256: 13740b4d6c1702d077c670ae17641b0892e21b7de2a4418f17953aa4d6664968
- URLQuery: https://screenshots.phishdestroy.io/uq/17f60e9a-5788-47ff-92e3-a83c3b766a71.png
  Source report: https://urlquery.net/report/17f60e9a-5788-47ff-92e3-a83c3b766a71
  SHA-256: f96e78bfed52018404a3277783a1bf34cd6b15117837710eee17ccc200e13438
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17326-ce00-74b3-8746-ff6a4d5a5cc7.png
  Captured: 2026-10-25 13:01:32 UTC
  Source report: https://urlscan.io/result/01a17326-ce00-74b3-8746-ff6a4d5a5cc7/
  SHA-256: f0c6224c1246f131cb4bd52a125636b4c10ac91afd107830d9ee434dfa323566
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173e6-bc2d-746b-926f-82485d004062.png
  Captured: 2026-10-25 16:31:10 UTC
  Source report: https://urlscan.io/result/01a173e6-bc2d-746b-926f-82485d004062/
  SHA-256: f0c6224c1246f131cb4bd52a125636b4c10ac91afd107830d9ee434dfa323566
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173ef-abac-727d-8508-15fb4dc69ea3.png
  Captured: 2026-10-25 16:40:55 UTC
  Source report: https://urlscan.io/result/01a173ef-abac-727d-8508-15fb4dc69ea3/
  SHA-256: f5b065b4168c83fec19681c7552010884e006065fa12d924ead808a92bad2af4
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17412-6b48-70a0-9984-43e17fb48a46.png
  Captured: 2026-10-25 17:18:52 UTC
  Source report: https://urlscan.io/result/01a17412-6b48-70a0-9984-43e17fb48a46/
  SHA-256: f0c6224c1246f131cb4bd52a125636b4c10ac91afd107830d9ee434dfa323566

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T17:32:12Z",
        "uuid": "01a173ec-8d75-7079-b9d3-6d7eafedec2b",
        "scanned_at": "2026-10-25T16:37:31Z",
        "final_url": "https://dhl-tracking.live/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dhl-tracking.live/",
                "from": "http://dhl-tracking.live/",
                "status": 307
            }
        ],
        "ip": "104.21.26.227",
        "domains": [
            "static.cloudflareinsights.com",
            "www.dhl.com"
        ],
        "ips": [
            "104.16.79.73",
            "104.21.26.227"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "feb0163cf638448ea56a0543fb4128d3d9c74ca350635d6fdf4e8a0bd3e5dd4d",
        "globals": [
            "trackPackage",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "*.dhl-tracking.live",
                "dhl-tracking.live"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "dhl-tracking.live",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-22T19:52:59Z",
            "valid_from": "2026-10-24T19:53:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "dhl"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "DHL"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T16:30:31Z",
        "uuid": "bdc2a691-371e-4396-bba4-699a49b61196",
        "scanned_at": "2026-10-25T16:26:58Z",
        "final_url": "https://dhl-tracking.live/",
        "status": 200,
        "history": [
            {
                "url": "https://dhl-tracking.live/",
                "status": 200
            }
        ],
        "dom_hash": "865c3ff7d0d49be8fb79f3bc733eb88c6ea98a5b4bd7971c420673bb915eca4b",
        "doc_hash": "feb0163cf638448ea56a0543fb4128d3d9c74ca350635d6fdf4e8a0bd3e5dd4d",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "New Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dhl-tracking.live",
                "type": "A",
                "value": "172.67.139.126"
            },
            {
                "name": "dhl-tracking.live",
                "type": "A",
                "value": "104.21.26.227"
            },
            {
                "name": "dhl-tracking.live",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:1ae3"
            },
            {
                "name": "dhl-tracking.live",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:8b7e"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.139.126",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-24T20:37:18Z",
            "updated": "2026-10-24T20:37:23Z",
            "expires": "2027-10-24T20:37:18Z",
            "nameservers": [
                "rafe.ns.cloudflare.com",
                "henrik.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T16:26:20Z",
        "analysis_at": "2026-10-25T15:46:13Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "categories": {
            "Google": "transportation",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-24T20:55:27Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.26.227"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "henrik.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:8b7e"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rafe.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:1ae3"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.139.126"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "henrik.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-25T15:51:40Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.dhl-tracking.live",
                "dhl-tracking.live"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "682792a45f8008326d9833be0fa5e9d953b",
            "sha256": "2162adfc38fe66601c54b0ce5cbf8e455ae3d9d524ad4354e6d140d74fb2d4e8",
            "subject": "dhl-tracking.live",
            "valid_to": "2027-01-22T19:52:59Z",
            "valid_from": "2026-10-24T19:53:00Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-24T20:37:18Z",
                "registration": "2026-10-24T20:37:18Z",
                "registrar expiration": "2027-10-24T20:37:18Z",
                "last update of RDAP database": "2026-10-24T20:55:16Z"
            },
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "registrar_iana_id": "1647"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:30:42Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "dhl-tracking.live"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T16:23:34Z",
            "first": "2026-10-25T16:23:34Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4248
        },
        "social_tags": {
            "title": "DHL Seguimiento — ¿Dónde está mi paquete?"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 12,
                "tls": 52,
                "wait": 65,
                "connect": 8,
                "download": 0
            },
            "response_ms": 137
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 7771,
            "co2_grams": 0.0003,
            "cleaner_than": 77
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.105",
                    "host": "henrik.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.216",
                    "host": "rafe.ns.cloudflare.com"
                }
            ],
            "zone": "dhl-tracking.live"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "dhl-tracking.live"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "rafe.ns.cloudflare.com",
                "henrik.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"henrik.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418378423, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://dhl-tracking.live"
            ]
        },
        "linked_pages": {
            "internal_count": 1
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "x-content-type-options": "nosniff"
            }
        }
    }
}
```