delivery-pack[.]hopto[.]org

This domain is flagged as a high-risk parcel delivery scam, designed to deceive users into disclosing sensitive information such as login credentials and payment details. The threat leverages social engineering tactics, typically through fraudulent notifications claiming to be from legitimate logistics providers, to trick victims into interacting with malicious content. Analysis indicates the domain delivery-pack.hopto.org exhibits multiple indicators of compromise. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious. The domain lacks an SSL certificate, increasing the risk of unencrypted data interception. Google Safe Browsing classifies it as phishing, and it appears on one security blocklist. Infrastructure analysis reveals the domain resolves to IP address 91.149.219.45, hosted in Finland under AS26383 (Baxet Group Inc.). The domain was registered on February 21, 2026, an unusually future date suggesting potential typosquatting or domain spoofing. The page title, '403 Forbidden,' may indicate recent takedown efforts or misconfigured server settings. Mitigation steps for this specific threat type include blocking the domain and its associated IP address (91.149.219.45) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing references to delivery-pack.hopto.org or similar logistics-themed lures. End-user training should emphasize verifying sender addresses, avoiding unsolicited parcel notifications, and inspecting URLs for anomalies such as mismatched domains or unusual TLDs. Security teams are advised to monitor for credential theft attempts originating from interactions with this domain and conduct retrospective analysis of logs for prior connections to the IP or domain.