Security Scan Report: manage.casamarmol.com.ve

Redirected to:
https://manage.casamarmol.com.ve/portal/users/delev/sub.php
Site favicon
Submitted: Completed: publiccompleted
This website contacted 5 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main domain is casamarmol.com.ve.

Submitted URL: https://manage.casamarmol.com.ve/portal/users/

Effective URL:
https://manage.casamarmol.com.ve/portal/users/delev/sub.php
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

DHL-branded phishing page on an unrelated domain using a fake failed-delivery fee lure, with a Telegram bot token embedded for exfiltration. Do not enter payment or personal data.

Risk Factors (5)
Impersonation of DHL Express brand on a non-DHL domain
Delivery-failure + unpaid-fee social-engineering lure directing to a payment step
Telegram bot token in page script for data exfiltration
External IP-lookup beacon (ipwho.is) consistent with phishing kit fingerprinting
Domain unranked and absent from Cisco Umbrella top 1M despite claiming a major brand
Domain age information unavailable

Details

Page Title

DHL

Scan Type

public

Domain Name Analysis

The domain 'manage.casamarmol.com.ve' uses the Venezuelan country-code top-level domain (.com.ve) with subdomain 'manage'. The second-level label 'casamarmol' is 10 characters long containing 4 vowels alongside 6 consonants. Splitting it apart reveals 3 words: casa, mar, mol. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

=A fPZ— DHL Express Help and Support gm A delivery attempt was unsuccessful. Home Ship Track Track number: 7391046285 Shipment type: Other Date: 07/11/2026 Amount: 0.99 € Status: in delivering Im...

Page Load Overview

1.59s
Total Load Time
390 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:545 chars
Detector Agreement:100%

Website Classification

Primary Category

news media journalism74% confidence
Type: static
Method: ml+structural

All Detected Categories

news media journalism
74%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
372.55.186.67Canada
AS32613Leaseweb Canada Inc.
2172.66.162.204Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
2104.20.44.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
115--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18B02B117AAF21096705394646A933BFA3DF88513C34ACD707A5C77A4DF8AAB29D4234C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:K+SBWDRSi/KgsZ4SdoVL42OVVi9odxp1AAviWquvKbvsVHpsMqTj:K+BDROtpsJ

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:8931:AGEBAAQhBxO0WhKH4XbMCsgfFjoDOoA2AElQgOCBLKQkEEhF5byAR2eIKgJEI4ACAOBKiICKuADCBIgoYkyuwoUkjkLMkBSQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00183c3c3c3c81ff
Perceptual Hash:9e1ff0608d7cc370
Difference Hash:3371697179e92537
Wavelet Hash:99183c3c3c3c81ff
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data