dpd[.]hvxqtrp[.]cfd

The domain dpd.hvxqtrp.cfd is identified as a high-risk phishing site specifically designed to impersonate DPD, a well-known international parcel delivery service. This domain employs social engineering tactics to deceive users into divulging sensitive information, such as login credentials or payment details, under the pretense of parcel tracking or delivery notifications. As of the latest assessment, the domain is currently offline, but its prior activity warrants continued monitoring and caution. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was flagged by 18 of 95 security vendors on VirusTotal, indicating a broad consensus on its phishing nature. It was registered through Aceville Pte. Ltd. on May 29, 2026, and resolves to the IP address 104.21.61.48, which is hosted behind Cloudflare’s infrastructure, a common tactic to obscure the true origin and evade detection. The domain appears on one security blocklist and is explicitly categorized under social engineering by Google Safe Browsing. The use of HTTP/3 further suggests an attempt to leverage modern protocols to bypass traditional security measures. Given the domain’s current offline status, immediate threats are mitigated; however, the infrastructure and registration details indicate a potential for resurgence. Organizations and individuals are advised to block the domain and its associated IP address (104.21.61.48) at the network level to prevent accidental access. Users should be educated on recognizing phishing attempts, particularly those impersonating courier services, and verify the legitimacy of any unexpected parcel notifications by directly accessing official DPD channels. Monitoring for similar domains registered through Aceville Pte. Ltd. or resolving to the same IP range may help preempt future threats. Security teams should also review logs for any prior interactions with this domain to assess potential exposure.