PhishPin / Brands Live Phishing Data / Shipping & delivery
Shipping & delivery phishing: which brands are copied the most
30 shipping & delivery brands are tracked in PhishPin's index. Together they have 7,637 hostnames in phishing feeds and 145 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated shipping & delivery
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | USPS | 76% | 79 · Critical | 5,791 | 6 |
| 2 | DHL | 6% | 60 · High | 429 | 7 |
| 3 | Royal Mail | 4% | 45 · Elevated | 294 | 0 |
| 4 | UPS | 3% | 49 · Elevated | 235 | 2 |
| 5 | Correos | 2% | 52 · Elevated | 183 | 6 |
| 6 | DPD | 2% | 48 · Elevated | 167 | 3 |
| 7 | Swiss Post | 1% | 36 · Elevated | 93 | 0 |
| 8 | An Post | 1% | 49 · Elevated | 92 | 10 |
| 9 | bpost | 1% | 31 · Moderate | 48 | 0 |
| 10 | Japan Post | 1% | 39 · Elevated | 44 | 4 |
| 11 | Chronopost | 0% | 29 · Moderate | 36 | 0 |
| 12 | Evri (Hermes) | 0% | 44 · Elevated | 35 | 17 |
| 13 | FedEx | 0% | 41 · Elevated | 31 | 10 |
| 14 | Canada Post | 0% | 34 · Moderate | 28 | 3 |
| 15 | La Poste | 0% | 36 · Elevated | 26 | 5 |
| 16 | Australia Post | 0% | 23 · Moderate | 17 | 0 |
| 17 | Colissimo | 0% | 26 · Moderate | 16 | 1 |
| 18 | Aramex | 0% | 28 · Moderate | 14 | 2 |
| 19 | Deutsche Post | 0% | 21 · Moderate | 13 | 0 |
| 20 | PostNL | 0% | 27 · Moderate | 11 | 3 |
| 21 | India Post | 0% | 24 · Moderate | 11 | 1 |
| 22 | Poste Italiane | 0% | 16 · Moderate | 7 | 0 |
| 23 | NZ Post | 0% | 21 · Moderate | 6 | 2 |
| 24 | GLS | 0% | 35 · Elevated | 4 | 57 |
| 25 | Correios | 0% | 17 · Moderate | 4 | 1 |
| 26 | Delhivery | 0% | 13 · Low | 2 | 1 |
| 27 | Purolator | 0% | 8 · Low | 0 | 3 |
| 28 | OnTrac | 0% | 4 · Low | 0 | 1 |
| 29 | Blue Dart | 0% | 0 · Low | 0 | 0 |
| 30 | LaserShip | 0% | 0 · Low | 0 | 0 |
Common lures against shipping & delivery
- A text saying a package could not be delivered and asking for a small "redelivery fee".
- An email with a tracking number that links to a cloned tracking page.
- A notice that your address is incomplete and the parcel will be returned.
- A customs or duty payment request for a parcel you were not expecting.
Red flags
- Real carriers do not ask for card details by text link to release a package.
- The tracking link goes to a lookalike domain instead of the carrier's official site.
- You were not expecting a parcel, or the tracking number does not exist on the official tracker.
If you already clicked or entered details
Do not enter more details. If you paid, call your card issuer to cancel the card and dispute the charge. Check any real parcel by typing the carrier's address into your browser and entering the tracking number there.
Is your delivery service being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which shipping & delivery brands are impersonated the most?
USPS leads with 5,791 hostnames in phishing feeds, followed by DHL (429) as of 1 Nov 2026.
How can I spot phishing that targets shipping & delivery?
Real carriers do not ask for card details by text link to release a package. The tracking link goes to a lookalike domain instead of the carrier's official site. You were not expecting a parcel, or the tracking number does not exist on the official tracker.
What should I do if I fall for a fake delivery service page?
Do not enter more details. If you paid, call your card issuer to cancel the card and dispute the charge. Check any real parcel by typing the carrier's address into your browser and entering the tracking number there.