dpd[.]mplzqrvxtn[.]ink

This domain, dpd.mplzqrvxtn.ink, is identified as a brand impersonation phishing site specifically targeting DPD parcel delivery services. Analysis indicates the site was designed to deceive users into entering sensitive information under the pretense of tracking or managing parcel deliveries. The domain is currently offline, though its infrastructure remains a potential threat for future malicious activity. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited and resolved to the IP address 172.67.180.233, which is associated with Cloudflare services. The site was flagged by 19 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. It appears on one security blocklist and was previously blocked by enterprise-grade security filters. The use of HTTP/3 and Cloudflare suggests an attempt to evade detection and improve site performance, common tactics in phishing campaigns. No creation date is available, but the domain's structure and naming convention align with known phishing patterns targeting logistics companies. At present, the domain is offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant, as domains of this nature are frequently reactivated or repurposed. It is recommended to block the domain and its associated IP address at the network level. Users who may have interacted with the site should monitor for unauthorized access to accounts or financial transactions. Security teams are advised to review logs for connections to 172.67.180.233 and investigate any related activity. Proactive measures, such as implementing DNS-based filtering and educating users on recognizing brand impersonation tactics, are critical to mitigating future risks from similar threats.