703%
increase in AI-driven phishing in a single year
Source: Outtake Labs, 2026
Private intelligence briefingProtect DHL trust across every digital surface.
Millions of autonomous agents detect, investigate, and dismantle impersonation, fraud, data leaks, extortion, and abuse infrastructure. The confirmed DHL phishing page is one proof point inside a much broader protection model.
Recon Agent / DHL record Confirmed
1
CONFIRMED PAGES
0.98
CONFIDENCE
6
PIVOT TYPES
YOLA
PRIMARY ACTION
❯ credential collection confirmed
❯ detection evasion documented
❯ no related infrastructure confirmed
01 / The problem
AI made it easy for adversaries to fake trust.
The perimeter expanded. Internal and external are now a single battlefield. Fake domains, cloned experiences, impersonation, extortion, and fraud move across surfaces faster than analyst queues can follow.
88%
of social engineering attacks now rely on impersonation as the core tactic
Source: Outtake Labs, 2026
84%
of organizations were hit by a digital risk incident
Source: 2026 Digital Risk Report
02 / One investigation in action
One page shows how Outtake turns a signal into action.
Recon Agent confirmed the impersonation, documented the evasion stack, and mapped the provider relationship. It is one example of the broader Digital Risk Protection platform at work.
Finding AMALICIOUS · 0.98
Credential phishing
A fake tracking action collected email and password credentials.
The page used DHL Express brand content to frame credential theft as routine parcel tracking. The form requested an email address and password before submitting through Yola’s form service.
1 confirmed pageEmail + passwordYola form backend
❯Preserve the page, form, and provider evidence in one case.
Finding BOBSERVED
Detection evasion
The page was built to frustrate automated inspection.
hCaptcha hid the credential fields from crawlers. The password label was obfuscated, the subdomain was randomized, the form destination was encrypted, and no custom analytics identifiers were available for pivoting.
hCaptcha gateObfuscated labelNo analytics pivots
❯Carry the evasion indicators into the provider evidence package.
Finding CHIGH PRIORITY
Disruption path
The strongest leverage sits with the Yola platform account.
The page, site identifier, user identifier, hCaptcha key, and form endpoint converge on Yola. The platform can investigate the account and decrypt the form destination during its abuse review.
Yola site IDYola user IDPlatform form endpoint
❯Submit the Yola abuse report and request account-level review.
03 / Investigation replay
One page in. A provider-ready evidence path out.
The output is not an inflated campaign claim. It is a precise map of the page, its evasion controls, its platform identifiers, and the strongest available action.
DHL tracking lure
Confirmed malicious page
Credential form
Email + password
hCaptcha gate
Blocks auto-scanning
Obfuscated label
Content evasion
Yola site record
11eee60c…4388e6
Yola user record
be3c43fb…3d62e4
Hosted form service
Credential exfil endpoint
Yola abuse path
Primary disruption target
Single confirmed page · no related infrastructure found
04 / Solutions
Digital Risk Protection across your entities.
One platform for the brands, leaders, locations, and products adversaries exploit to create false trust.
01
Fake domains · Fraud
Brand Protection
Fake domains. Cloned apps. Malicious ads. Outtake finds the campaign behind each one and takes it down.
Explore solution02
PII leaks · Extortion
Executive Protection
Impersonation. Doxxing. Extortion. Outtake catches the threat before it reaches your leaders.
Explore solution03
Disruption · Threats
Location Protection
Event threats, venue risk, on-site safety. Outtake reveals the threat landscape to keep events safe.
Explore solution04
SaaS abuse · Token fraud
Product Protection
Unauthorized resale. Trial abuse. Token fraud. Outtake shuts down the operation before it scales.
Explore solution05 / Proven outcomes
Results the world’s top brands rely on.
Millions of autonomous agents detect, investigate, and dismantle threats across every digital surface. No analyst queue.
90%+
Social takedowns complete in under 24 hours.
100s
100+ platforms, marketplaces, and dark web sources indexed by agentic search.
Millions
Autonomous agents running in parallel, each one sharper with every takedown.
Zero
0 queues. 0 tickets. Agents work every threat to the end, and you see all of it.
Organizations protected by Outtake
Private working session
See Outtake work the full threat lifecycle.
Use the DHL investigation as a starting point, then map how autonomous agents can detect, investigate, and dismantle threats across the full digital surface.