dpd[.]xvnrqtlpmz[.]cloud

The domain dpd.xvnrqtlpmz.cloud has been identified as a phishing site impersonating DPD, the international parcel delivery company. This threat is classified as generic phishing, likely attempting to harvest login credentials or personal information from victims expecting package delivery notifications. The site may utilize a fake DPD login page or a credential harvesting form, though no specific drainer kit has been associated. The domain was registered on May 27, 2026, through Dominet (HK) Limited, a Hong Kong-based registrar often linked to malicious domains. It resolves to IP address 104.21.42.139, which is associated with Cloudflare, a common CDN used to obscure the true hosting location.

Technical indicators paint a clear picture of risk. VirusTotal analysis shows that 10 out of 95 security vendors flag this domain as malicious or phishing, signaling broad industry recognition of its danger. Google Safe Browsing specifically flags the domain for phishing, meaning users attempting to access the site through Chrome or other Google-integrated browsers will receive a warning. The domain appears on at least one security blocklist, and its current status remains active. These metrics collectively indicate a high-confidence threat that is already operational.

As of the latest check, dpd.xvnrqtlpmz.cloud is still active and accessible, posing an ongoing risk to users. PhishDestroy recommends immediate avoidance of this domain. If you have visited the site, do not enter any personal information, especially DPD account credentials or payment details. Consider changing any passwords that may have been compromised and monitor your accounts for suspicious activity. The domain should be reported to Google Safe Browsing and your email provider to help protect others. While the phishing site remains live, the primary risk is credential theft leading to account takeover or financial fraud.