What happened
MalwareTips published an investigation on 9 November 2026 into a FedEx-themed voicemail scam. A published sample of the voicemail says there may be a problem with a package's delivery address and tells the listener to visit a named website, fedexyg.com, before November 24 or the package will be returned. FedEx is impersonated and is not involved; its real site is fedex.com.
How the scam works
MalwareTips checked 22 look-alike domains built as fedex plus two or three letters and found they share registration patterns: 18 sit at registrar Dominet (HK) Limited, several were registered in the same second (fedexyc.com, fedexyg.com and fedexyj.com on 4 November 2026), and the newest, fedexlhp.com, was registered on 7 November. Live domains show a fake Cloudflare-style Verify you are human check served from a Python server, which sends a tracking beacon and redirects clicks to hidden .top addresses including vicesdhsqqt.top, vicesdhsqqz.top, qantemovixra.top and draxemulipqor.top. Other listed look-alikes include fedexql.com, fedexns.com, fedextm.com, fedexvq.com, fedexyd.com, fedexwt.com, fedexwv.com, fedexeq.com, fedexew.com, fedexkqt.com, fedexra.com, fedexru.com, fedexrz.com, fedextwq.com, fedexktm.com, fedexts.com, fedexyr.com and fedextwm.com. Eleven of the 22 are on client hold.
MalwareTips did not see the final page; other published descriptions say callers may push remote-access software, ID photos or a small holding fee. Delivery voicemails create urgency because people fear losing a package, and a deadline such as November 24 pushes them to click before checking.
Never visit a website named in an unexpected delivery voicemail. Track parcels only via fedex.com or the official app, and forward suspicious messages to abuse@fedex.com. Anyone who entered card details or installed remote-access software should contact their bank and have the device checked.
Source
MalwareTips investigation, 9 November 2026: https://malwaretips.com/blogs/fedex-voicemail-scam-domains-fake-cloudflare-check/
