VirusTotal
7 / 89 engine detections
Buka laporan“delivery-claim.cfd”
Peniruan MetaMask: delivery-claim.cfd — Konten tidak tersedia. Ringkasan bukti: VirusTotal 7/89 (alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet…
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
7 / 89 engine detections
Buka laporanDBL_PHISH
checked — no detections recorded
Buka laporan4 community references
Buka laporanprovider verdict: clean
Buka laporanNo threat flag
Buka laporanNo malicious flag
Buka laporanResults reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
delivery-claim.cfd is an impersonation phishing site built around a parcel or delivery claim theme. It targets people who expect a package or receive a message about one. PhishDestroy first flagged it on 2026-09-11. The site is now dead, and its DNS stopped resolving on 2026-10-19.
Delivery-claim lures usually start with a text or email saying a shipment is on hold. The victim is told to confirm their address or pay a small redelivery fee, and is sent to a page posing as a courier or retailer. Whatever goes into the form is captured, including name, address, phone, card numbers and sometimes login or wallet details. That data is then used for fraud or follow-up scams. Here the page title showed only the bare domain name, so no specific brand could be identified from it.
Seven of 89 VirusTotal engines flagged the domain as of 2026-09-13: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, LevelBlue and SOCRadar. That count is modest, but the vendors are independent of each other. Spamhaus lists the domain in its DBL under the phishing category. MetaMask's and SEAL's blocklists include it alongside PhishDestroy's, which means crypto-focused defenders also treat it as a threat. Four AlienVault OTX pulses reference it as well.
The domain was registered on 2025-09-08 through Web Commerce Communications Limited (WebNic.cc), about a year before PhishDestroy detected it. That gap is consistent with a domain held in reserve before use. It was served from the Trellian Pty. Limited network, geolocated to the US, on the low-cost .cfd extension. A free Let's Encrypt certificate gave it the padlock icon, which proves nothing about the site's legitimacy.
If you entered card details, contact your bank to block the card and dispute any unknown charges. Watch for further delivery or bank texts, since attackers reuse stolen contact details for follow-up scams. If you typed in a password, change it wherever you use it and turn on two-factor authentication. If you connected a crypto wallet or signed anything, revoke token approvals and move funds to a fresh wallet if you shared a seed phrase. Defenders should block the domain and treat unexpected delivery-fee messages as phishing by default.
Last checked
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
ns100.webnic.ccns101.webnic.ccsynth-ip-c0a86410.delivery-claim.cfdLocation describes the IP network.
5f14158203e2ea4193c49ed972e8acfc9c38f8ce8eb36cae72726af38baf4e62dallversid.sbsdandeslembangmarinding.sitedeepundergroundevents.comdesktops-user-app.comdesktops-users-apps.comdesportopg.codgswora33.cfddiroesteticapop.shopdodoexl.iodopdii5000.icudreqpayord.comdronenation.onlineecosalutepop.shopelqoriva.worldfanpages-advertisiessubmit.my.idfecondation.orgfenobea.comfffsd9ug.topffpal.cnffssp.vipfggijklmm.xyzfghiijkmn.xyzfghikklmn.xyzfgijkllmn.xyzfhxy-j-jvtckjk.topfhxy-s-bjtnfii.topfhxy-s-nkmdjfa.ccfhxy-s-ponobtg.topfhxy-s-tjnogvq.topfhxy-s-whktoxd.ccfiberglass-pools.shopfideltylocaltext.sbsfigashoppop.shopfilgistoreitpop.shopfinancialdefault.ccfinancialdesert.infofinancialdis.ccfinancialdisaster.infofindintuitresearch.digitalfindwithfortislawpartnerssales.onefirmfoundationng.orgfirstcharitydao.clubflexdriveode.comgb73.ccwww.dallversid.sbswww.dandeslembangmarinding.sitewww.deepundergroundevents.comwww.delivery-claim.cfdwww.desktops-user-app.comwww.desktops-users-apps.comwww.dgswora33.cfdwww.diroesteticapop.shopwww.dodoexl.iowww.dopdii5000.icuwww.dreqpayord.comwww.dronenation.onlinewww.ecosalutepop.shopwww.elqoriva.worldwww.fanpages-advertisiessubmit.my.idwww.figashoppop.shopwww.filgistoreitpop.shopSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of delivery-claim.cfd · checked Sep 11, 2026
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
delivery-claim.cfd
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
Tidak diketahui→dns_inactive
dns_nxdomain
Dapat dijangkau→Tidak tersedia
Tidak diketahui→live_content
content_served
redirected→live_content
content_served
live_content→redirected
http_redirect
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
live_content→redirected
http_redirect
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
live_content→redirected
http_redirect
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
Tidak diketahui→live_content
content_served
Tidak tersedia→Dapat dijangkau
Tidak diketahui→inactive
parked · parking_or_lifecycle_page
Tidak diketahui→inactive
parked · parking_or_lifecycle_page
Tidak diketahui→inactive
parked · parking_or_lifecycle_page
Dapat dijangkau→Tidak tersedia
Tidak tersedia→Dapat dijangkau
Dapat dijangkau→Tidak tersedia
Dapat dijangkau
4 community references
View sourceNo threat flag
View source7/89 engine detections
View sourcePD-20260911-2FC59B
Page captured
View sourcedelivery-claim.cfd
View source79 domain serupa tersimpan
PD-20260911-2FC59B Recipient: abuse@trellian.com Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
delivery-claim.cfd)Meskipun kamu belum mengetahui semua detailnya — tetap saja ajukan laporan. Informasi yang tidak lengkap tetap dapat membantu penyelidikan.
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanLaporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauPantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.