VirusTotal
7 / 89 engine detections
보고서 열기“delivery-claim.cfd”
MetaMask 사칭: delivery-claim.cfd — 콘텐츠를 사용할 수 없음. 증거 요약: VirusTotal 7/89 (alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft); Spamhaus…
원본 포렌식 기록을 보존하기 위해 아래의 상세 PhishDestroy AI 분석은 영어로 유지됩니다.
7 / 89 engine detections
보고서 열기DBL_PHISH
checked — no detections recorded
보고서 열기4 community references
보고서 열기provider verdict: clean
보고서 열기No threat flag
보고서 열기No malicious flag
보고서 열기Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
delivery-claim.cfd is an impersonation phishing site built around a parcel or delivery claim theme. It targets people who expect a package or receive a message about one. PhishDestroy first flagged it on 2026-09-11. The site is now dead, and its DNS stopped resolving on 2026-10-19.
Delivery-claim lures usually start with a text or email saying a shipment is on hold. The victim is told to confirm their address or pay a small redelivery fee, and is sent to a page posing as a courier or retailer. Whatever goes into the form is captured, including name, address, phone, card numbers and sometimes login or wallet details. That data is then used for fraud or follow-up scams. Here the page title showed only the bare domain name, so no specific brand could be identified from it.
Seven of 89 VirusTotal engines flagged the domain as of 2026-09-13: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, LevelBlue and SOCRadar. That count is modest, but the vendors are independent of each other. Spamhaus lists the domain in its DBL under the phishing category. MetaMask's and SEAL's blocklists include it alongside PhishDestroy's, which means crypto-focused defenders also treat it as a threat. Four AlienVault OTX pulses reference it as well.
The domain was registered on 2025-09-08 through Web Commerce Communications Limited (WebNic.cc), about a year before PhishDestroy detected it. That gap is consistent with a domain held in reserve before use. It was served from the Trellian Pty. Limited network, geolocated to the US, on the low-cost .cfd extension. A free Let's Encrypt certificate gave it the padlock icon, which proves nothing about the site's legitimacy.
If you entered card details, contact your bank to block the card and dispute any unknown charges. Watch for further delivery or bank texts, since attackers reuse stolen contact details for follow-up scams. If you typed in a password, change it wherever you use it and turn on two-factor authentication. If you connected a crypto wallet or signed anything, revoke token approvals and move funds to a fresh wallet if you shared a seed phrase. Defenders should block the domain and treat unexpected delivery-fee messages as phishing by default.
Last checked
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
ns100.webnic.ccns101.webnic.ccsynth-ip-c0a86410.delivery-claim.cfdLocation describes the IP network.
5f14158203e2ea4193c49ed972e8acfc9c38f8ce8eb36cae72726af38baf4e62dallversid.sbsdandeslembangmarinding.sitedeepundergroundevents.comdesktops-user-app.comdesktops-users-apps.comdesportopg.codgswora33.cfddiroesteticapop.shopdodoexl.iodopdii5000.icudreqpayord.comdronenation.onlineecosalutepop.shopelqoriva.worldfanpages-advertisiessubmit.my.idfecondation.orgfenobea.comfffsd9ug.topffpal.cnffssp.vipfggijklmm.xyzfghiijkmn.xyzfghikklmn.xyzfgijkllmn.xyzfhxy-j-jvtckjk.topfhxy-s-bjtnfii.topfhxy-s-nkmdjfa.ccfhxy-s-ponobtg.topfhxy-s-tjnogvq.topfhxy-s-whktoxd.ccfiberglass-pools.shopfideltylocaltext.sbsfigashoppop.shopfilgistoreitpop.shopfinancialdefault.ccfinancialdesert.infofinancialdis.ccfinancialdisaster.infofindintuitresearch.digitalfindwithfortislawpartnerssales.onefirmfoundationng.orgfirstcharitydao.clubflexdriveode.comgb73.ccwww.dallversid.sbswww.dandeslembangmarinding.sitewww.deepundergroundevents.comwww.delivery-claim.cfdwww.desktops-user-app.comwww.desktops-users-apps.comwww.dgswora33.cfdwww.diroesteticapop.shopwww.dodoexl.iowww.dopdii5000.icuwww.dreqpayord.comwww.dronenation.onlinewww.ecosalutepop.shopwww.elqoriva.worldwww.fanpages-advertisiessubmit.my.idwww.figashoppop.shopwww.filgistoreitpop.shopSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of delivery-claim.cfd · checked Sep 11, 2026
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
delivery-claim.cfd
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
알 수 없음→dns_inactive
dns_nxdomain
접속 가능→이용 불가
알 수 없음→live_content
content_served
redirected→live_content
content_served
live_content→redirected
http_redirect
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
live_content→redirected
http_redirect
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
live_content→redirected
http_redirect
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
알 수 없음→live_content
content_served
이용 불가→접속 가능
알 수 없음→inactive
parked · parking_or_lifecycle_page
알 수 없음→inactive
parked · parking_or_lifecycle_page
알 수 없음→inactive
parked · parking_or_lifecycle_page
접속 가능→이용 불가
이용 불가→접속 가능
접속 가능→이용 불가
접속 가능
4 community references
View sourceNo threat flag
View source7/89 engine detections
View sourcePD-20260911-2FC59B
Page captured
View sourcedelivery-claim.cfd
View source저장된 유사 도메인 79개
PD-20260911-2FC59B Recipient: abuse@trellian.com 계정 자격 증명, 개인 정보 또는 결제 정보를 입력했거나 이 도메인에서 파일을 다운로드한 경우 즉시 조치를 취하세요. 다음은 사건을 신고하고 자신을 보호하는 데 도움이 되는 리소스입니다.
공식 사이버 범죄 연락처 또는 불만사항 초안 작성 →를 받으려면 국가를 선택하세요.
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
delivery-claim.cfd)비록 모든 세부 사항을 알지 못하더라도 — 어쨌든 신고를 하세요. 부분적인 정보라도 수사에 도움이 됩니다.
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.