delv[.]ghanapost[.]vip

Analysis of delv.ghanapost.vip indicates this domain was a generic phishing site targeting users of Ghana Post or related postal services. The domain was registered on March 16, 2026, through NameSilo, LLC, and resolved to IP 188.114.97.3, part of Cloudflare's network (AS13335). The site's infrastructure relied on Cloudflare services, including Browser Insights and HTTP/3 support, and used a Let's Encrypt SSL certificate for encryption. At the time of assessment, the domain displayed a default 'Welcome to nginx!' page title, suggesting either misconfiguration or an attempt to evade detection by not loading malicious content immediately.

The domain appeared on one security blocklist and was flagged by 15 of 94 security vendors on VirusTotal, with PhishDestroy actively blocking it. These detections, combined with the domain's registration details and hosting on Cloudflare, align with common phishing infrastructure patterns. The use of Cloudflare nameservers (chad.ns.cloudflare.com and dahlia.ns.cloudflare.com) is consistent with threat actors leveraging CDN services to obscure origin servers and improve resilience against takedowns. As of July 23, 2026, the domain is offline, though its prior activity and detection history warrant continued monitoring.

Defenders should treat this domain as compromised and block it at the network level. Organizations targeting Ghana or postal service users should include this domain in threat intelligence feeds and monitor for related infrastructure, such as similarly named subdomains or IPs within Cloudflare's AS13335 range. The exact phishing kit or payload remains unconfirmed due to the lack of accessible content during analysis.