dpd[.]fqplqwr[.]cfd

This domain, dpd.fqplqwr.cfd, is identified as a parcel delivery phishing site designed to harvest user credentials and payment details under the guise of a legitimate logistics provider. Analysis indicates the infrastructure employs social engineering tactics, presenting itself as a shipment tracking or delivery notification portal. No specific drainer kit signatures were observed, but the domain follows common phishing patterns associated with fraudulent parcel services. Infrastructure analysis reveals the domain was registered on May 29, 2026, through Aceville Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.30.124, which is proxied through Cloudflare, obscuring the origin server. Google Safe Browsing flags the domain under the SOCIAL_ENGINEERING category, and it appears on one security blocklist. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious. The site employs HTTP/3, a protocol rarely used in legitimate phishing campaigns but increasingly adopted by threat actors to evade detection. As of the latest verification, dpd.fqplqwr.cfd has been taken offline, likely in response to blocklist inclusions or abuse reports. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future campaigns. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range. Users are advised to verify parcel delivery notifications directly through official channels and avoid interacting with unsolicited tracking links.