Investigation of a Courier Brand Impersonation Scam: A Case Study of the CDEK Delivery Fraud

Courier-related phishing and impersonation scams have become a persistent threat, exploiting user trust in logistics providers and the rapid growth of e-commerce. This article presents a detailed case study of a delivery scam that impersonated the international courier company CDEK. The investigation reconstructs the full attack chain, beginning with initial social engineering via telephone contact and continuing through the use of a fraudulent web domain designed to harvest sensitive information. Technical artifacts including domain registration details, TLS certificate misuse, web content structure, and interaction flow are analyzed to illustrate how attackers combine psychological manipulation with low-cost technical infrastructure. The study highlights common weaknesses in user awareness, brand protection, and domain abuse monitoring that enable such scams to succeed. Based on the findings, practical detection indicators and mitigation recommendations are proposed for security teams, domain registrars, and end users. The case demonstrates how real-world incident investigations can contribute actionable insights into modern phishing operations and complement existing academic research on social engineering and online fraud (Cloudflare, 2025; Let’s Encrypt, 2021).