# PhishDestroy domain threat record: mydpd.yjbow.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/mydpd.yjbow.top/
Machine-readable companion: https://phishdestroy.io/domain/mydpd.yjbow.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:19:29 UTC
- Last availability or vendor check: 2026-10-26 11:00:24 UTC
- Stored record updated: 2026-10-26 21:02:08 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: dpd

## Stored infrastructure

- Observed IP address: 209.141.47.167
- Registrar in stored WHOIS data: NameSilo,LLC
- Registrar country in stored WHOIS data: US

## Evidence links

- URLScan report: https://urlscan.io/result/01a17325-d1ca-7619-a219-af210557a900/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/mydpd.yjbow.top
- Certificate Transparency search: https://crt.sh/?q=%25.mydpd.yjbow.top
- Web Archive lookup: https://web.archive.org/web/*/https://mydpd.yjbow.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot shows an HTTP ERROR 404 page stating that this mydpd.yjbow.top page can't be found and offering a Reload button, observed on 2026-10-25. PhishDestroy listed the domain on 2026-10-25 because Google Safe Browsing flagged SOCIAL_ENGINEERING; a separate urlscan capture that day retrieved a DPD-themed parcel-tracking page, and 2026-10-25 is the first-seen date.

How the scam works
The page supports a category risk in which people contacted about a DPD delivery are steered to a lookalike tracking experience on mydpd.yjbow.top and asked to enter personal, address or payment details, or to pay a delivery fee, under the cover of a parcel-tracking lure.

Evidence
The captured screenshot itself shows only the 404 error page and Reload button, while the urlscan capture on 2026-10-25 reached a DPD-labelled tracking path and scored it malicious at 100 with an ML score of 95. VirusTotal flagged the domain as malicious, Google Safe Browsing flagged SOCIAL_ENGINEERING, and the PhishDestroy assessment classified it as impersonation phishing. Spamhaus listed the domain in the phishing category on 2026-10-25, Cloudflare Radar recorded HTTP 404 on 2026-10-25 matching the screenshot, and the page fetch followed no cross-site redirect. PhishDestroy internal blocklist listed the domain on 2026-10-26 while external blocklists and DNS blocklists showed 0 listings across 12 resolvers and OTX recorded 0 pulses; site inspection of the captured page shows a Vue-based front end with headless-browser detection globals, 23 network requests, and 3 distinct script SHA256 hashes for campaign pivoting, the first beginning e9473ffd649e.

Infrastructure
Notable weaknesses: no Content-Security-Policy, no X-Frame-Options, no X-Content-Type-Options, no Referrer-Policy, no Permissions-Policy, no COOP/COEP/CORP, and DNSSEC unsigned. TLS 1.3 with AES-256-GCM, forward secrecy and ALPN http/1.1; HSTS present without preload; no email authentication records observed; no CAA record observed. The recorded hosting was PONYNET, FranTech Solutions, United States, on an openresty server, first observed 2026-10-25.

What to do
If you entered credentials, change your password on the genuine DPD account service and enable two-factor authentication; if you shared card details, contact your bank. For defenders, block mydpd.yjbow.top, retain the three recorded script hashes for pivoting, and alert on messages linking to this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17325-d1ca-7619-a219-af210557a900/
Cloudflare Radar report: https://radar.cloudflare.com/scan/221a5d7f-dc45-4775-814a-324f398e3c93
Stored capture screenshot: https://urlscan.io/screenshots/01a17325-d1ca-7619-a219-af210557a900.png
Cloudflare Radar screenshot (2026-10-25T16:27:24Z): https://screenshots.phishdestroy.io/cf/221a5d7f-dc45-4775-814a-324f398e3c93.png
URLScan screenshot (2026-10-25T11:45:57Z): https://screenshots.phishdestroy.io/us/01a172e1-97e9-756f-b15e-c5400e4ec174.png
URLScan capture report: https://urlscan.io/result/01a172e1-97e9-756f-b15e-c5400e4ec174/
VirusTotal report: https://www.virustotal.com/gui/domain/mydpd.yjbow.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mydpd.yjbow.top
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 21:02:08 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17325-d1ca-7619-a219-af210557a900.png
  Captured: 2026-10-25 16:19:29 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17325-d1ca-7619-a219-af210557a900.png
  Captured: 2026-10-26 04:30:23 UTC
  Source report: https://urlscan.io/result/01a17325-d1ca-7619-a219-af210557a900/
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a172e1-97e9-756f-b15e-c5400e4ec174.png
  Captured: 2026-10-25 11:45:57 UTC
  Source report: https://urlscan.io/result/01a172e1-97e9-756f-b15e-c5400e4ec174/
  SHA-256: f8ad244987aa8f7d454efd0c7180a4c6b7e216efdaa5798779db74f19608f5ec
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/221a5d7f-dc45-4775-814a-324f398e3c93.png
  Captured: 2026-10-25 16:27:24 UTC
  Source report: https://radar.cloudflare.com/scan/221a5d7f-dc45-4775-814a-324f398e3c93
  SHA-256: 3604afebffb01e066fd14c0b5c575590083559d77d42c8d91c70552062a15772

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T16:31:48Z",
        "uuid": "01a17325-d1ca-7619-a219-af210557a900",
        "scanned_at": "2026-10-25T13:00:31Z",
        "final_url": "https://mydpd.yjbow.top/track-ch/",
        "status": 200,
        "ip": "209.141.47.167",
        "ips": [
            "209.141.47.167"
        ],
        "asns": [
            "53667"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "fc44e3259a86f10a0a33cd2c5aadf85fe0d22606f1cf7e113f194c3edf630139",
        "script_hashes": [
            "e9473ffd649e62a74805adc6cc89c6b29ce7f925748af7f5a1e8135e1e17e8ee",
            "08ddd24c236084d324a27b8287a3833a62facd69d50e01476d43ca410c24eb7d",
            "d0b8826fb0964ef7b075835c14fe14a06f991eb3f606cd26d4452b1e3e1c2dd7"
        ],
        "globals": [
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "HeadlessDetectorModules",
            "HeadlessDetectorUtils",
            "detectHeadless",
            "getWorkerChecks",
            "HeadlessDetector",
            "__headlessDetectionReady",
            "__VUE__"
        ],
        "cookies": [
            "_vt"
        ],
        "storage_keys": [
            "2e14a1ac17c37597f4579a51c5f26330"
        ],
        "tls": {
            "san": [
                "mydpd.yjbow.top"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "mydpd.yjbow.top",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T06:04:17Z",
            "valid_from": "2026-10-25T06:04:18Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "dpd"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "DPD"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html;charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T16:31:49Z",
        "uuid": "221a5d7f-dc45-4775-814a-324f398e3c93",
        "scanned_at": "2026-10-25T16:27:24Z",
        "final_url": "https://mydpd.yjbow.top/",
        "status": 404,
        "history": [
            {
                "url": "https://mydpd.yjbow.top/",
                "status": 404
            }
        ],
        "dom_hash": "4dbc72dffccc8f8b936ed5c6039471f9fdd0adc6168a644b2f27e26a223c4772",
        "doc_hash": "d294cb85db825076bd78e4e91425293de30bc08fed7533d1a2dbc85a29c2e15c",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "mydpd.yjbow.top",
                "type": "A",
                "value": "209.141.47.167"
            }
        ],
        "dnssec_valid": false,
        "ip": "209.141.47.167",
        "whois": {
            "registrar": "NameSilo,LLC",
            "created": "2026-10-24T02:47:41Z",
            "updated": "2026-10-24T02:47:45Z",
            "expires": "2027-10-24T02:47:41Z",
            "nameservers": [
                "ns1.dnsowl.com.",
                "ns2.dnsowl.com.",
                "ns3.dnsowl.com."
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T17:02:15Z",
        "analysis_at": "2026-10-25T16:15:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 3,
            "suspicious": 2,
            "undetected": 37
        },
        "detections": {
            "G-Data": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "suspicious",
            "Gridinsoft": "phishing",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "registrar": "NameSilo,LLC",
        "created": "2026-10-24T02:47:41Z",
        "expires": "2027-10-24T02:47:41Z",
        "updated": "2026-10-24T02:47:45Z",
        "first_seen": "2026-10-25T07:51:57Z",
        "dns": [
            {
                "ttl": 7207,
                "type": "A",
                "value": "209.141.47.167"
            }
        ],
        "dns_at": "2026-10-25T16:20:59Z",
        "jarm": "29d29d00029d29d00042d42d00000090d94d1f02cef4051cfd1d66dbe44eb0",
        "cert": {
            "san": [
                "mydpd.yjbow.top"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5c5d2fb7840c76636c9d81a80b2845bb47",
            "sha256": "57b5008172e224ae357cd36491f124877ff2631ea29c00bd515c30a4e69b47d5",
            "subject": "mydpd.yjbow.top",
            "valid_to": "2027-01-23T06:04:17Z",
            "valid_from": "2026-10-25T06:04:18Z"
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "https://www.namesilo.com",
            "created": "2026-10-24T02:47:41Z",
            "updated": "2026-10-24T02:47:45Z",
            "expires": "2027-10-24T02:47:41Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:32:10Z",
        "caa_records": {
            "domain": "mydpd.yjbow.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.234",
                    "host": "ns3.dnsowl.com"
                },
                {
                    "ip": "162.159.26.136",
                    "host": "ns1.dnsowl.com"
                },
                {
                    "ip": "162.159.26.49",
                    "host": "ns2.dnsowl.com"
                }
            ],
            "zone": "yjbow.top"
        },
        "location": {
            "ip": "209.141.47.167",
            "asn": "53667",
            "org": "FranTech Solutions",
            "city": "Las Vegas",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "mydpd.yjbow.top"
        },
        "dns": {
            "A": [
                "209.141.47.167"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains",
            "message": "HSTS header does not contain the preload directive."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000; includeSubDomains",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "209.141.47.167",
            "family": 4
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "created": "2026-10-24T02:47:41Z",
            "updated": "2026-10-24T02:47:45Z",
            "expires": "2027-10-24T02:47:41Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "openresty",
                "content-type": "text/plain;charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains"
            }
        }
    }
}
```