Delivery & payments
DHL Express: Payment Needed for Your DHL Package | Review of a DHL delivery-fee phish
This message asks for an extra $1.65 before delivery can proceed. Its payment host includes the DHL name but is not a subdomain of the official DHL domain.
Public EML case analysis · An archived 2025 message
A $1.65 delivery fee may seem too small to question. This public email claims delivery can begin as soon as that amount is paid. Its Date header is 2025-12-05. A small amount does not establish that a payment request is genuine.
An excerpt from the message
Selected text from the public EML, reconstructed for this article. Personal details are redacted; working links and remote images are omitted. This is not a screenshot of the original inbox. The original English is retained.
The brand name inside a separate domain
The Pay 1.65 USD Now button points to www[.]dhlpayonline[.]com. It includes the DHL name but is not a subdomain of dhl[.]com. That observation alone does not establish ownership or any payment-processing relationship.
The body also contains a waybill number and an address for a payment notification, both redacted in the public reconstruction. A separate notification button points to del[.]dhl[.]com. That official-domain link does not validate the payment button.
The claimed delivery fee remains unverified
The From address uses a subdomain of firebaseapp[.]com. We were not given order records, delivery records or confirmation of an extra charge. We therefore do not claim that the recipient never ordered anything, or that all delivery-fee notices are phishing.
The headers contain spf=pass, dkim=pass and dmarc=none. These records do not establish that the fee is legitimate. We did not visit the payment page, so we cannot confirm a request for card details, a completed payment or any loss.
Start with the order record before paying
If you are expecting a parcel, check the retailer's order record or open DHL's official website yourself to verify the shipment and any charge. A waybill number and brand name in an email are not enough to justify payment. DHL's guidance below explains how to report suspicious messages.
Source and scope
This case uses a message extracted as EML from the 2025 Jose Nazario phishing corpus. It is a public collection sample, not an email submitted by a reader to this site. Dates refer to the message's Date header, not an independently established incident date.
We inspected saved headers, body text and embedded addresses without visiting destination sites. The selected message has no document attachments. The reconstruction removes personal details and excerpts the body; the Korean and English explanations are our own. The corpus is provided under CC BY 4.0.