FedEx Voicemail Phishing (Vishing)

What it is

FedEx voicemail phishing is a voice phishing, or vishing, campaign that impersonates the parcel carrier to steal payment card data. An automated voicemail claims there is a problem with a package’s delivery address and names a website to visit before a deadline. The site is a cloned FedEx tracking page that asks for a small redelivery fee.

Fake delivery-fee lures have run by text and email for years. Delivering one by voicemail sidesteps the filters built for those channels. The recording never names FedEx; the brand appears only in the domain, a brand-plus-suffix lookalike domain such as fedexwm[.]com or fedexyd[.]com. The operator rotates through them, registering new ones almost daily as registrars suspend the old.

If you already entered your card

The payment page collects everything needed to use a card online. An error after you submit it, such as a request for a different card, does not mean the details were not captured.

• Call your card issuer now. Use the number on the back of the card, report the fraud, and ask for a replacement card rather than monitoring the old one. If you entered a second card after the error, replace that one too.
• Expect follow-up scams. The kit also collects your name, address, email, and phone number. Treat unexpected calls, texts, or emails that cite them as suspect, including ones that claim to be from your bank or FedEx.
• Report it. Send the details to FedEx at [email protected], the address it gives for suspicious messages, and in the US file a report at reportfraud.ftc.gov.

Is the website in my voicemail part of this scam?

If the voicemail named a website made of “fedex” plus one to three letters and .com, treat it as this scam. FedEx tracking lives only on fedex.com.

The ones people have searched for or reported include fedexwm, fedexyd, fedexvy, fedexvw, fedexfd, fedexvr, fedexpw, fedexkwp, fedexgw, and fedexfw, all .com. As of October 7, 2026, we have tied 129 domains in this pattern to the campaign, the earliest registered on September 3, and about 280 have been registered in it, often several in the same minute. New ones appear almost daily, so a name not listed here is not a sign that it is safe.

On a computer, the website opens apple.com. The site checks what kind of device is visiting. Phones get the fake verification page; computers are redirected to Apple’s homepage, so checking the link from a laptop shows nothing wrong. The redirect does not make the site safe, and Apple has nothing to do with it.

How it works

1. Voicemail Lure. An automated delivery notice warns of a problem with the package’s delivery address, names a website to visit by a deadline one day out, and says the package will otherwise go back to the sender. Caller numbers rotate; the reported ones share the 986 area code. On iPhone, the voicemail transcript renders the spoken domain as a tappable link.

   

2. Fake Cloudflare Gate. The lookalike domain first checks the visitor’s browser. Computers are redirected to apple.com; phones get a Cloudflare-style checkbox asking the visitor to prove they are human. It is not Cloudflare: the page comes from a Python (Uvicorn) app behind a Caddy proxy, and the Ray ID is a random value generated in the browser. Unlike the ClickFix version of this lure, it asks only for a click, which is logged to /api/click_report before the victim is forwarded to a second domain.

   

3. Fake hCaptcha. The second domain is a .shop address that rotates too: dexalorin[.]shop behind fedexwm, bifrentov[.]shop behind fedexyd. It shows a mock hCaptcha checkbox drawn in SVG and CSS, with no call to the real service. Clicking it appends a session token (__eat) and reloads into the payload. FedEx’s fraud page currently warns about messages that link to .shop domains.

4. Cloned Tracking Page. A FedEx-branded app shows a fake tracking number, 784259631027, and a failed-delivery status. On load it opens a Socket.IO WebSocket to /console/, a live channel back to the operator’s panel typical of kits built for real-time fraud.

5. Personal Data Harvest. The victim picks a new delivery window and enters their full name, street address, email, and phone number.

6. Card Harvest. A payment page, citing a supposed FedEx policy, charges $1.20 for redelivery and asks for the card number, expiry, and CVV. A test card drew an error asking for a different card, on a button that misspells “another”. The fee is a pretext; the card, and ideally a second one, is the goal.

   

Why it still works

• Voice Skips the Filters. Carrier SMS filtering and email gateways never see a voicemail, and the transcript hands the victim a working link anyway.
• A Small, Plausible Ask. Most people are expecting a package at any given time, and $1.20 is too little to feel like fraud.
• Borrowed Security Theater. Two familiar bot checks make the site feel protected. They also hide the payload: the domain in the voicemail never serves anything FedEx-branded, so a crawler or registrar checking it sees only a generic verification page, or, from a desktop browser, apple.com.

Signals to watch for

• A Voicemail That Names a Website. Real FedEx tracking lives on fedex.com. A voicemail pointing anywhere else to fix a delivery is the lure.
• A “fedex” Plus Letters Domain. Names like fedexyd[.]com or fedexkmw[.]com belong to this campaign’s rotation, not to FedEx.
• A Link That Opens apple.com on a Computer. The gate redirects desktop browsers to Apple’s homepage and shows the scam only to phones.
• A Bot Check Before a Tracking Page. A Cloudflare or hCaptcha check that hands you off to an unrelated domain, such as a .shop address, is the kit, not the carrier.
• Fake Cloudflare Artifacts. A real Cloudflare challenge carries Server: cloudflare and a cf-ray response header. One served by uvicorn or another origin, with a Ray ID that appears in no header, is fake.
• Infrastructure Signals. WebSocket upgrades to /console/?uuid=...&EIO=4 and POSTs to /api/click_report on newly registered domains are high-confidence indicators of this kit, as is a uvicorn origin that answers desktop user agents with a 302 to https://www.apple.com.

How to defend against it

• Check the package at the source. Look up the shipment yourself on fedex.com or in the FedEx app. Never visit a domain read out in a voicemail.
• Report the number. Use your phone’s report-spam option, and in the US file a report at reportfraud.ftc.gov.
• For card issuers: reissue on a reported delivery-fee scam rather than monitoring. The kit collects name, billing address, card number, expiry, and CVV, everything card-not-present fraud needs.
• For security and brand teams: block the domains and IPs below, but match on the pattern rather than the list. The gate has run on at least eight addresses at three hosting providers, and new lure domains register almost daily on a small set of nameservers (share-dns, dyna-ns, Njalla). Registrars had suspended about two thirds of the lure domains by October 7 without slowing the rotation, so report the payload .shop domain with every lure; removing only the one in the voicemail leaves the kit free to point a new lure at the same payload.

Why it appears here

Package-delivery scams are among the most common consumer lures, and this campaign shows the kits behind them maturing: a voice channel that bypasses message filtering, a clean redirector domain that hides the brand abuse, and a live operator channel on the payload. Nothing in the gate or the operator channel is specific to FedEx, and the lookalike domains the chain depends on are visible at registration, before the first voicemail goes out: about 280 in five weeks, all following one pattern. Both domains respond to the registrar and hosting-provider abuse process described in our phishing site takedown guide.

Indicators of compromise

Lookalike FedEx domains

• Pattern: fedex[a-z]{1,3}\.com. As of October 7, 2026, 129 domains in this pattern are tied to the campaign, and about 280 were registered in it from September 3.
• Searched for or reported: fedexwm[.]com, fedexyd[.]com, fedexvy[.]com, fedexvw[.]com, fedexfd[.]com, fedexvr[.]com, fedexpw[.]com, fedexkwp[.]com, fedexgw[.]com, fedexfw[.]com

Domains and URLs

• dexalorin[.]shop (fake hCaptcha and FedEx payment app, behind fedexwm[.]com)
• bifrentov[.]shop (fake hCaptcha and FedEx payment app, behind fedexyd[.]com)
• /api/click_report?lid=2&tid=21 (click telemetry on the gate; lid=34&tid=2250 on fedexyd[.]com)
• /query/?__eat=<token> (payload entry path)
• /console/?uuid=<uuid>&shopHost=&EIO=4&transport=websocket (operator WebSocket)

IP Addresses

• Gate, Spartan Host: 193.218.201[.]170, 193.218.201[.]163, 193.218.201[.]211, 193.218.201[.]231
• Gate, FastNet Data: 154.23.175[.]6, 154.23.175[.]9, 154.19.229[.]75
• Gate, Tencent Cloud: 43.172.38[.]49
• Payload: 193.218.201[.]135 (dexalorin[.]shop), 43.166.131[.]150 (bifrentov[.]shop)

Lure Artifacts

• Caller numbers: +1 (986) 291-9712 (observed); +1 (986) 270-3769 and +1 (986) 283-3199 (reported elsewhere, unconfirmed)
• Fake tracking number: 784259631027
• Fee amount: $1.20, split into service, storage, and tax lines

Technical Artifacts

• Server headers: uvicorn with Via: 1.1 Caddy on the gate; openresty on the payload host.
• Device cloaking: the gate answers desktop user agents with a 302 to https://www.apple.com and serves the fake check only to mobile user agents.
• Gate script: the payload URL is stored base64-encoded in an encTarget variable; the fake check is localized into nine languages.
• Registration pattern: lure domains registered in batches, often several in the same minute, through Onamae, Gname, Realtime Register, Dominet, Cosmotown, and other registrars, on share-dns.com/share-dns.net, dyna-ns.net, or Njalla nameservers.
• Session cookie: _vt (UUID value, 10-minute lifetime) on the payload host.
• Page metadata: <meta> tags on the payment app describing it as a login page (purpose, page-type, security-level), plus a long hex keywords value.