# PhishDestroy domain threat record: dpd-calviro.click

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dpd-calviro.click/
Machine-readable companion: https://phishdestroy.io/domain/dpd-calviro.click/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 10:40:38 UTC
- Last availability or vendor check: 2026-10-25 23:00:29 UTC
- Stored record updated: 2026-10-25 23:22:23 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: wordpress

## Stored infrastructure

- Observed IP address: 104.21.96.140
- Registrar in stored WHOIS data: Dominet (HK) Limited
- Registrar country in stored WHOIS data: CN
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-20 05:19:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a15fc6-9ce8-70c2-ab11-0dd03b746534/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dpd-calviro.click
- Certificate Transparency search: https://crt.sh/?q=%25.dpd-calviro.click
- Web Archive lookup: https://web.archive.org/web/*/https://dpd-calviro.click/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed dpd-calviro.click as a suspicious domain based on a Google Safe Browsing social‑engineering flag. The recorded page title is "HIFA Cordless Welding Machine – Shanghai HIFA Electric Co., Ltd" and the site returned HTTP 200 on 2026-10-25. The domain was first seen by PhishDestroy on 2026-10-25.

How the scam works
The classification falls under generic phishing or social‑engineering risk, where attackers present seemingly legitimate content to lure users into revealing credentials, personal data, or performing unwanted actions. No specific malicious behavior was observed on the captured page, so the risk is inferred from external signals rather than direct evidence of credential harvesting or malware delivery.

Evidence
Google Safe Browsing flagged the domain for social engineering on 2026-10-25. VirusTotal recorded 16 detections (15 malicious, 1 suspicious) from 92 engines on 2026-10-23, with vendors such as BitDefender, ESET, Fortinet and others labeling it phishing. urlscan.io’s engine score was 72 and marked it malicious, though its overall verdict was non‑malicious on 2026-10-21. Cloudflare Radar identified the site as phishing on 2026-10-25. The external blocklist Phishunt also contains the domain, and PhishDestroy’s internal list marks it as blocked. OTX reported zero pulses.

Infrastructure
The domain was registered on 2026-04-20 through Dominet (HK) Limited. The recorded DNS entries listed Cloudflare IPs 104.21.96.140 and 172.67.181.165, which are associated with Cloudflare, Inc. in Canada. TLS uses a Let’s Encrypt certificate valid until 2027-01-16. Nameservers are darwin.ns.cloudflare.com and aliza.ns.cloudflare.com, and DNSSEC is not enabled.

What to do
Visitors should avoid entering any credentials or personal information on the site; if data was submitted, change passwords on the affected accounts. Security teams can block dpd-calviro.click at the firewall or proxy, monitor DNS queries for the recorded IPs, and add the domain to internal blocklists. Review logs for any connections to the domain and treat any disclosed credentials as compromised.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15fc6-9ce8-70c2-ab11-0dd03b746534/
Cloudflare Radar report: https://radar.cloudflare.com/scan/2e0f3939-2b4f-4f82-a90b-4c27cf0b2985
Stored capture screenshot: https://urlscan.io/screenshots/01a15fc6-9ce8-70c2-ab11-0dd03b746534.png
Cloudflare Radar screenshot (2026-10-25T10:43:40Z): https://screenshots.phishdestroy.io/cf/2e0f3939-2b4f-4f82-a90b-4c27cf0b2985.png
URLScan screenshot (2026-10-19T01:13:53Z): https://screenshots.phishdestroy.io/us/01a151b8-ca89-7084-9795-6ebd0b918e28.png
URLScan capture report: https://urlscan.io/result/01a151b8-ca89-7084-9795-6ebd0b918e28/
URLScan screenshot (2026-10-19T10:18:15Z): https://screenshots.phishdestroy.io/us/01a153aa-f603-73a6-b58b-68fad2572f8e.png
URLScan capture report: https://urlscan.io/result/01a153aa-f603-73a6-b58b-68fad2572f8e/
URLScan screenshot (2026-10-19T22:56:11Z): https://screenshots.phishdestroy.io/us/01a15661-115c-774b-a97e-69758f989133.png
URLScan capture report: https://urlscan.io/result/01a15661-115c-774b-a97e-69758f989133/
VirusTotal report: https://www.virustotal.com/gui/domain/dpd-calviro.click
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dpd-calviro.click
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 10:46:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a15fc6-9ce8-70c2-ab11-0dd03b746534.png
  Captured: 2026-10-25 10:40:38 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a15fc6-9ce8-70c2-ab11-0dd03b746534.png
  Source report: https://urlscan.io/result/01a15fc6-9ce8-70c2-ab11-0dd03b746534/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2e0f3939-2b4f-4f82-a90b-4c27cf0b2985.png
  Captured: 2026-10-25 10:43:40 UTC
  Source report: https://radar.cloudflare.com/scan/2e0f3939-2b4f-4f82-a90b-4c27cf0b2985
  SHA-256: daab956d62ede30cf43b3356822e6878d9faeb4358ef3d64a271eae823117aec
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151b8-ca89-7084-9795-6ebd0b918e28.png
  Captured: 2026-10-19 01:13:53 UTC
  Source report: https://urlscan.io/result/01a151b8-ca89-7084-9795-6ebd0b918e28/
  SHA-256: ce8e63253b38e3e6ff6717a69a547a1be4d64b19ccede19359f8630324361f4b
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a153aa-f603-73a6-b58b-68fad2572f8e.png
  Captured: 2026-10-19 10:18:15 UTC
  Source report: https://urlscan.io/result/01a153aa-f603-73a6-b58b-68fad2572f8e/
  SHA-256: ce8e63253b38e3e6ff6717a69a547a1be4d64b19ccede19359f8630324361f4b
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15661-115c-774b-a97e-69758f989133.png
  Captured: 2026-10-19 22:56:11 UTC
  Source report: https://urlscan.io/result/01a15661-115c-774b-a97e-69758f989133/
  SHA-256: ce8e63253b38e3e6ff6717a69a547a1be4d64b19ccede19359f8630324361f4b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T10:45:20Z",
        "uuid": "01a15fc6-9ce8-70c2-ab11-0dd03b746534",
        "scanned_at": "2026-10-21T18:43:43Z",
        "final_url": "https://dpd-calviro.click/",
        "status": 200,
        "ip": "172.67.181.165",
        "domains": [
            "www.hifacordless.com",
            "cdn.gtranslate.net",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.80.73",
            "104.26.13.42",
            "43.165.7.37",
            "172.67.181.165"
        ],
        "asns": [
            "13335",
            "132203"
        ],
        "countries": [
            "DE"
        ],
        "link_domains": [
            "www.hifacordless.com",
            "www.facebook.com",
            "www.youtube.com",
            "twitter.com",
            "vk.com",
            "www.instagram.com",
            "api.whatsapp.com"
        ],
        "social": [
            "https://www.facebook.com/people/Hifa-Welding/61554271892409",
            "https://www.youtube.com/@HIFA-Welding",
            "https://twitter.com/crealse76521",
            "https://www.instagram.com/hifa.welding",
            "https://api.whatsapp.com/send"
        ],
        "doc_hash": "337d34f59864f87ddd771f6ba5afd342942e234a9ec23e77ba6ff778b0b34ea3",
        "script_hashes": [
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "jQuery",
            "wc_add_to_cart_params",
            "woocommerce_params",
            "___FONT_AWESOME___",
            "fontawesome-free-shims",
            "astra",
            "astraGetParents",
            "astraToggleClass",
            "astraTriggerEvent",
            "astraSmoothScroll",
            "astScrollToTopHandler",
            "popupTriggerClick",
            "AstraToggleSubMenu",
            "AstraToggleSetup",
            "astraNavMenuToggle",
            "elementorModules",
            "elementorFrontendConfig",
            "__elementorChunks",
            "__elementorLoadChunk",
            "elementorFrontend",
            "Swiper",
            "Sticky",
            "sbjs",
            "wc_order_attribution",
            "gtranslateSettings",
            "webpackChunkelementor_pro",
            "wp",
            "ElementorProFrontendConfig",
            "elementorProFrontend",
            "Cookies",
            "on_keydown_remove_from_cart",
            "focus_populate_live_region",
            "refresh_sorted_by_live_region",
            "on_document_ready",
            "doGTranslate",
            "_wpemojiSettings",
            "__cfBeacon"
        ],
        "cookies": [
            "sbjs_migrations",
            "sbjs_current_add",
            "sbjs_first_add",
            "sbjs_current",
            "sbjs_first",
            "sbjs_udata",
            "sbjs_session"
        ],
        "storage_keys": [
            "elementor",
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "*.dpd-calviro.click",
                "dpd-calviro.click"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "dpd-calviro.click",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-16T16:05:41Z",
            "valid_from": "2026-10-18T16:05:42Z"
        },
        "domain_age_days": 183,
        "apex_age_days": 183,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 66,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 72,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T10:45:23Z",
        "uuid": "2e0f3939-2b4f-4f82-a90b-4c27cf0b2985",
        "scanned_at": "2026-10-25T10:43:40Z",
        "final_url": "https://dpd-calviro.click/",
        "status": 200,
        "history": [
            {
                "url": "https://dpd-calviro.click/",
                "status": 200
            }
        ],
        "dom_hash": "63bc4f7cfd73e4a214a43531e36d76317486c77f3e47dde5c76c75d89a8d26d1",
        "doc_hash": "7fd16bae16f5df29b7de416bd985d575a05a32d6e1b659eb25d6cc5479a5843e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dpd-calviro.click",
                "type": "A",
                "value": "104.21.96.140"
            },
            {
                "name": "dpd-calviro.click",
                "type": "A",
                "value": "172.67.181.165"
            },
            {
                "name": "dpd-calviro.click",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:608c"
            },
            {
                "name": "dpd-calviro.click",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b5a5"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.96.140",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-04-20T07:19:01Z",
            "updated": "2026-04-25T07:19:39Z",
            "expires": "2027-04-20T07:19:01Z",
            "nameservers": [
                "darwin.ns.cloudflare.com",
                "aliza.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T10:42:55Z",
        "analysis_at": "2026-10-23T09:51:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 15,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "DNS8": "phishing",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-04-20T00:00:00Z",
        "first_seen": "2026-04-21T10:48:17Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aliza.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "darwin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b5a5"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.181.165"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.96.140"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:608c"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aliza.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T09:51:28Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.dpd-calviro.click",
                "dpd-calviro.click"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6459c71a5c0539b67cffe829c489f88310e",
            "sha256": "4c4337f7e747541a382964803fe34ce77de33af01ce0f471ad0bddfd913248a0",
            "subject": "dpd-calviro.click",
            "valid_to": "2027-01-16T16:05:41Z",
            "valid_from": "2026-10-18T16:05:42Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-04-20T07:19:02Z",
                "registration": "2026-04-20T07:19:02Z",
                "registrar expiration": "2027-04-20T07:19:02Z",
                "last update of RDAP database": "2026-04-20T07:19:02Z"
            },
            "registrar": "Dominet (HK)Limited",
            "registrar_iana_id": "3775"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T10:45:44Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "dpd-calviro.click"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://www.hifacordless.com/wp-sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 25
        },
        "social_tags": {
            "title": "HIFA Cordless Welding Machine – Shanghai HIFA Electric Co., Ltd",
            "robots": "max-image-preview:large",
            "generator": "WordPress 7.1.2"
        },
        "trackers": {
            "requests": 60
        },
        "mixed_content": {
            "no_sri": [
                "https://www.hifacordless.com/wp-includes/js/jquery/jquery.min.js",
                "https://www.hifacordless.com/wp-includes/js/jquery/jquery-migrate.min.js",
                "https://www.hifacordless.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js",
                "https://www.hifacordless.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js",
                "https://www.hifacordless.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js",
                "https://www.hifacordless.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js",
                "https://www.hifacordless.com/wp-content/plugins/elementor/assets/lib/font-awesome/js/v4-shims.min.js",
                "https://www.hifacordless.com/wp-content/themes/astra/assets/js/minified/frontend.min.js",
                "https://www.hifacordless.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js",
                "https://www.hifacordless.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js"
            ],
            "third_party_scripts": 23
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 8,
                "tls": 24,
                "wait": 1203,
                "connect": 23,
                "download": 15
            },
            "response_ms": 1273
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 170520,
            "co2_grams": 0.0062,
            "cleaner_than": 10
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.151",
                    "host": "darwin.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.55",
                    "host": "aliza.ns.cloudflare.com"
                }
            ],
            "zone": "dpd-calviro.click"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "sbjs_migrations",
                    "session": true
                },
                {
                    "name": "sbjs_current_add",
                    "session": true
                },
                {
                    "name": "sbjs_first_add",
                    "session": true
                },
                {
                    "name": "sbjs_current",
                    "session": true
                },
                {
                    "name": "sbjs_first",
                    "session": true
                },
                {
                    "name": "sbjs_udata",
                    "session": true
                },
                {
                    "name": "sbjs_session"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3032::ac43:b5a5",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "dpd-calviro.click"
        },
        "dns": {
            "A": [
                "104.21.96.140",
                "172.67.181.165"
            ],
            "NS": [
                "aliza.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"aliza.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417828763, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3033::6815:608c",
                "2606:4700:3032::ac43:b5a5"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3033::6815:608c",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://dpd-calviro.click"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.hifacordless.com/product/",
                "https://www.hifacordless.com/battery-powered/",
                "https://www.hifacordless.com/technology/",
                "https://www.hifacordless.com/about/",
                "https://www.hifacordless.com/",
                "https://www.hifacordless.com/home/",
                "https://www.hifacordless.com/dual-powered/",
                "https://www.hifacordless.com/application/",
                "https://www.hifacordless.com/category/uncategorized/",
                "https://www.hifacordless.com/hello-world/",
                "https://www.hifacordless.com/author/chris/",
                "https://www.facebook.com/people/Hifa-Welding/61554271892409/",
                "https://www.youtube.com/@HIFA-Welding",
                "https://twitter.com/crealse76521",
                "https://vk.com/hifa.welding",
                "https://www.instagram.com/hifa.welding/",
                "https://www.hifacordless.com//application/",
                "https://www.hifacordless.com/dual-powered",
                "https://api.whatsapp.com/send/"
            ],
            "external_count": 19,
            "internal_count": 2
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-04-20T07:19:01Z",
            "updated": "2026-04-25T07:19:39Z",
            "expires": "2027-04-20T07:19:01Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "darwin.ns.cloudflare.com",
                "aliza.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```