# PhishDestroy domain threat record: mydpd.ixrii.help

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mydpd.ixrii.help/
Machine-readable companion: https://phishdestroy.io/domain/mydpd.ixrii.help/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 16:15:39 UTC
- Stored record updated: 2026-10-26 21:11:02 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 209.141.47.167
- Registrar in stored WHOIS data: NameSilo, LLC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1784c-6aa9-7028-84d0-e48455753e1d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mydpd.ixrii.help
- Certificate Transparency search: https://crt.sh/?q=%25.mydpd.ixrii.help
- Web Archive lookup: https://web.archive.org/web/*/https://mydpd.ixrii.help/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added the domain to its blocklist on 2026-10-26 because Google Safe Browsing reported a social‑engineering threat. A page fetch on that date returned HTTP 200 and redirected to /track-ch/. A Cloudflare Radar scan of the root URL on the same day returned HTTP 404, indicating the site may no longer serve content at that path.

How the scam works
The alerts are consistent with typical social‑engineering sites that mimic legitimate brands to lure users into entering personal or tracking information. No specific malicious payload, credential‑harvesting form, or wallet interaction was observed in the captured page content.

Evidence
VirusTotal recorded seven detections on 2026-10-26, with four vendors (ESET, G‑Data, Sophos, Google Safe Browsing) labeling it malicious and three (Fortinet, SOCRadar, LevelBlue) marking it suspicious. Google Safe Browsing flagged the domain for social‑engineering on the same date. urlscan.io scanned the site on 2026-10-26 and returned a malicious verdict with a score of 100, categorising it as phishing and associating it with the DPD brand. OpenPhish listed the domain and PhishDestroy’s internal list also marks it as malicious, while OTX reported zero pulses.

Infrastructure
The recorded IP address 209.141.47.167 belongs to FranTech Solutions in the United States (ASN 53667). The domain uses a Let’s Encrypt certificate issued on 2026-10-26, valid until 2027-01-24, and the TLS record shows a 89‑day validity period. Domain age, apex age and TLS age are all zero days, indicating the domain and its certificate were created on the day of first observation. Nameservers are ns1.dnsowl.com, ns2.dnsowl.com and ns3.dnsowl.com.

What to do
Do not submit any credentials, tracking numbers or personal data to the site; if you have already done so, change related passwords and monitor accounts for unauthorized activity. Security teams should block the exact domain, review proxy and firewall logs for connections to 209.141.47.167, and enforce strict TLS verification for outbound traffic. Continue monitoring reputable threat feeds for any future activity linked to this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1784c-6aa9-7028-84d0-e48455753e1d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/a6033358-174d-4268-a900-ecef91d3e72a
Stored capture screenshot: https://urlscan.io/screenshots/01a1784c-6aa9-7028-84d0-e48455753e1d.png
Cloudflare Radar screenshot (2026-10-26T16:19:30Z): https://screenshots.phishdestroy.io/cf/a6033358-174d-4268-a900-ecef91d3e72a.png
VirusTotal report: https://www.virustotal.com/gui/domain/mydpd.ixrii.help
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mydpd.ixrii.help
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 16:53:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1784c-6aa9-7028-84d0-e48455753e1d.png
  Captured: 2026-10-26 16:15:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1784c-6aa9-7028-84d0-e48455753e1d.png
  Source report: https://urlscan.io/result/01a1784c-6aa9-7028-84d0-e48455753e1d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a6033358-174d-4268-a900-ecef91d3e72a.png
  Captured: 2026-10-26 16:19:30 UTC
  Source report: https://radar.cloudflare.com/scan/a6033358-174d-4268-a900-ecef91d3e72a
  SHA-256: f47c11aa71584f7f62424022d914f711c343c431d1d4f70271c93013488cfa7f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:03Z",
        "uuid": "01a1784c-6aa9-7028-84d0-e48455753e1d",
        "scanned_at": "2026-10-26T13:00:46Z",
        "final_url": "https://mydpd.ixrii.help/track-ch/",
        "status": 200,
        "redirected": "same-domain",
        "ip": "209.141.47.167",
        "ips": [
            "209.141.47.167"
        ],
        "asns": [
            "53667"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "e74b1e60634c5662ef8cd2ac7e5623f553bafc69942f0379b765f74b0df30f29",
        "script_hashes": [
            "e9473ffd649e62a74805adc6cc89c6b29ce7f925748af7f5a1e8135e1e17e8ee",
            "08ddd24c236084d324a27b8287a3833a62facd69d50e01476d43ca410c24eb7d",
            "d0b8826fb0964ef7b075835c14fe14a06f991eb3f606cd26d4452b1e3e1c2dd7"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "HeadlessDetectorModules",
            "HeadlessDetectorUtils",
            "detectHeadless",
            "getWorkerChecks",
            "HeadlessDetector",
            "__headlessDetectionReady",
            "__VUE__"
        ],
        "cookies": [
            "_vt"
        ],
        "storage_keys": [
            "2e14a1ac17c37597f4579a51c5f26330"
        ],
        "tls": {
            "san": [
                "mydpd.ixrii.help"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "mydpd.ixrii.help",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-24T07:00:06Z",
            "valid_from": "2026-10-26T07:00:07Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "dpd"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "DPD"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html;charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:09Z",
        "uuid": "a6033358-174d-4268-a900-ecef91d3e72a",
        "scanned_at": "2026-10-26T16:19:30Z",
        "final_url": "https://mydpd.ixrii.help/",
        "status": 404,
        "history": [
            {
                "url": "https://mydpd.ixrii.help/",
                "status": 404
            }
        ],
        "dom_hash": "4dbc72dffccc8f8b936ed5c6039471f9fdd0adc6168a644b2f27e26a223c4772",
        "doc_hash": "12d1c30616ec9038f1aff285c027ec87220cfc2b6d6a638dcf8269d4d8d606b4",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mydpd.ixrii.help",
                "type": "A",
                "value": "209.141.47.167"
            }
        ],
        "dnssec_valid": false,
        "ip": "209.141.47.167",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-26T07:28:27Z",
            "updated": "2026-10-26T07:28:31Z",
            "expires": "2027-10-26T23:59:59Z",
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:51:01Z",
        "analysis_at": "2026-10-26T16:16:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 4,
            "suspicious": 3,
            "undetected": 38
        },
        "detections": {
            "ESET": "phishing",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "suspicious",
            "LevelBlue": "suspicious",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "registrar": "NameSilo, LLC",
        "created": "2026-10-26T07:28:27Z",
        "expires": "2027-10-26T23:59:59Z",
        "updated": "2026-10-26T07:28:31Z",
        "first_seen": "2026-10-26T08:03:46Z",
        "dns": [
            {
                "ttl": 7207,
                "type": "A",
                "value": "209.141.47.167"
            }
        ],
        "dns_at": "2026-10-26T16:22:05Z",
        "jarm": "29d29d00029d29d00042d42d00000090d94d1f02cef4051cfd1d66dbe44eb0",
        "cert": {
            "san": [
                "mydpd.ixrii.help"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5da283727495642d6c149bfc315e9e529e9",
            "sha256": "11ac0a51a04797c838313ed429dfeca3476e648bfca869082fc85d0e1998884b",
            "subject": "mydpd.ixrii.help",
            "valid_to": "2027-01-24T07:00:06Z",
            "valid_from": "2026-10-26T07:00:07Z"
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "https://www.namesilo.com",
            "created": "2026-10-26T07:28:27Z",
            "updated": "2026-10-26T07:28:31Z",
            "expires": "2027-10-26T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:30Z",
        "caa_records": {
            "domain": "mydpd.ixrii.help"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.173",
                    "host": "ns1.dnsowl.com"
                },
                {
                    "ip": "162.159.26.49",
                    "host": "ns2.dnsowl.com"
                },
                {
                    "ip": "162.159.27.98",
                    "host": "ns3.dnsowl.com"
                }
            ],
            "zone": "ixrii.help"
        },
        "location": {
            "ip": "209.141.47.167",
            "asn": "53667",
            "org": "FranTech Solutions",
            "city": "Las Vegas",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "mydpd.ixrii.help"
        },
        "dns": {
            "A": [
                "209.141.47.167"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains",
            "message": "HSTS header does not contain the preload directive."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000; includeSubDomains",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "209.141.47.167",
            "family": 4
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-26T07:28:27Z",
            "updated": "2026-10-26T07:28:31Z",
            "expires": "2027-10-26T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "openresty",
                "content-type": "text/plain;charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains"
            }
        }
    }
}
```