dpd[.]xvnrptqlmz[.]ink

This domain, dpd.xvnrptqlmz.ink, is identified as a phishing site impersonating DPD, a global parcel delivery service. Analysis indicates the threat type as brand impersonation, designed to deceive victims into entering sensitive credentials or payment details under the guise of legitimate parcel tracking or delivery notifications. No specific crypto drainer kit signatures were detected, but the domain exhibits characteristics consistent with credential harvesting infrastructure targeting logistics customers. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited and currently resolves to the IP address 188.114.97.3, a Cloudflare-protected endpoint utilizing HTTP/3. Detection metrics show 11 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. No creation date was provided in available intelligence, but the use of Cloudflare suggests an attempt to obscure hosting origins and evade takedown efforts. The domain has been taken offline, reducing immediate risk to end users. However, the registrar and hosting infrastructure remain active, allowing threat actors to potentially redeploy similar phishing domains. Organizations should monitor for newly registered domains under the same registrar or resolving to the same IP range. Users who interacted with the domain prior to takedown should reset credentials for any associated accounts and review financial transactions for unauthorized activity. Network-level blocking of the IP 188.114.97.3 is recommended as a precautionary measure.