dpd[.]kplxqvr[.]cfd

This domain, dpd.kplxqvr.cfd, is identified as a credential theft operation specifically impersonating DPD, a global parcel delivery service. Analysis indicates the site employs social engineering tactics to deceive victims into entering login credentials or personal information through fraudulent parcel tracking interfaces. No direct evidence of crypto drainer functionality or associated kits was observed, though credential harvesting remains the primary threat vector. Infrastructure analysis reveals multiple high-confidence indicators: the domain is flagged by 17 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The domain was registered on May 29, 2026, through Aceville Pte. Ltd., and resolves to IP address 172.67.160.158, which is proxied through Cloudflare’s network. Additional technical observations include HTTP/3 protocol usage and a single security blocklist entry via PhishDestroy. The creation date suggests either a typo-squatting attempt or advanced preparation for future campaigns. As of the latest assessment, dpd.kplxqvr.cfd has been taken offline, likely due to automated takedown mechanisms or registrar intervention. However, residual risk persists due to the domain’s recent registration and the potential for rapid redeployment under similar infrastructure. Organizations and individuals are advised to monitor for related domains using the same registrar or IP range, and to implement strict filtering for domains mimicking logistics brands. End users should verify parcel tracking links through official DPD channels only and treat unsolicited delivery notifications with heightened scrutiny.