dpd[.]czqplwn[.]cfd

PhishDestroy has identified dpd.czqplwn.cfd as a high-risk phishing domain that specifically impersonates the DPD courier brand to steal credentials. The site is currently offline, but its recent activity posed a significant threat to users. This domain was created on May 29, 2026, and registered through Aceville Pte. Ltd., a registrar often associated with malicious domains. It resolves to IP address 188.114.96.3, which has been linked to other phishing operations. VirusTotal analysis shows that 12 out of 95 security vendors flagged this domain as malicious, and Google Safe Browsing also marks it as a phishing site. The domain appears on one security blocklist, and it lacks an SSL certificate, further indicating its fraudulent nature. The page title, dpd.czqplwn.cfd, was designed to mimic the legitimate DPD tracking interface, tricking users into entering personal information.

Although the domain has been taken offline, the infrastructure behind it may still be active or reused for future campaigns. Users who may have interacted with this site should change their passwords immediately and monitor accounts for suspicious activity. PhishDestroy recommends enabling multi-factor authentication on all accounts and being cautious of unsolicited package tracking links. Organizations should block the domain at the network level and educate employees about phishing tactics that exploit trusted brand names.