mactrac-act[.]org

The domain mactrac-act.org is a confirmed phishing site engaged in brand impersonation targeting DHL. It presents itself as a legitimate shipping or tracking service to deceive users into entering sensitive information, such as login credentials or personal data. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, but prior activity remains a concern for potential victims.

Technical analysis of mactrac-act.org reveals limited but notable detection. The domain was flagged by 1 of 95 VirusTotal security vendors, specifically CRDF, and appears on 1 security blocklist (PhishDestroy). It was registered through NameSilo, LLC on September 21, 2022, and resolves to the IP address 198.23.190.194, hosted on AS36352 (HostPapa) in the US. No SSL certificate was observed, and the page title displayed was 'MACTRAC-ACT'. Google Safe Browsing did not flag the domain, and Gridinsoft assigned it a trust score of 0/100.

Users who interacted with mactrac-act.org should take immediate steps to secure their accounts. If login credentials were entered, change passwords for the affected service and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity, such as unexpected transactions or password reset attempts. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (DHL) to aid in takedown efforts and prevent further victimization.