fancourierbox.net presents itself as a potentially malicious site, focusing on phishing and account hijacking. This domain mimics the official tracking page of the Romanian delivery service FAN Courier. It uses a fake delivery issue notification to trick users into linking their WhatsApp account to an attacker-controlled device using a pairing code.
Historical and current IP address mappings for this domain.
| IP Address / Infrastructure | Status | Subdomains | Last Seen |
|---|---|---|---|
CLOUDFLARENET - Cloudflare, Inc. (AS13335) | Historical | fancourierbox.net | 2 days ago |
CLOUDFLARENET - Cloudflare, Inc. (AS13335) | Historical | fancourierbox.net | 2 days ago |
Real experiences from people who visited this domain
URLert analyzed recent scan activity for fancourierbox.net
No public scans recorded recently
Be the first to run a threat analysis on this domain.
Access this classification data programmatically via our API.
{
"domain": "fancourierbox.net",
"confidence": "high",
"category": {
"purpose": "potentially_malicious",
"specialization": "Phishing and Account Hijacking"
},
"identity": {
"headline": "Malicious site impersonating FAN Courier to hijack WhatsApp accounts",
"summary": "This domain mimics the official tracking page of the Romanian delivery service FAN Courier. It uses a fake delivery issue notification to trick users into linking their WhatsApp account to an attacker-controlled device using a pairing code.",
"operator": null,
"parent_entity": null,
"topics": [
"phishing",
"scam",
"whatsapp hijacking",
"courier impersonation",
"cybercrime"
]
},
"functions": {
"is_ugc_platform": false,
"is_file_host": false,
"is_url_shortener": false,
"is_public_idp": false,
"is_crypto_platform": false,
"allows_user_subdomains": false,
"is_form_builder": false,
"is_document_host": false
},
"facts": {
"registered_date": "2026-02-03T06:20:23Z",
"rank": null,
"hosting_provider": "CLOUDFLARENET - Cloudflare, Inc."
}
}