depop[.]order5315[.]cfd

PhishDestroy identifies depop.order5315.cfd as an active credential-harvesting domain masquerading as a legitimate Depop order page. The site is designed to deceive users into entering their Depop login credentials, which are then exfiltrated to attacker-controlled infrastructure. Affected users risk account takeover, unauthorized transactions, or identity theft. Domains like this exemplify the persistent threat of spoofed login portals in e-commerce ecosystems. This domain was flagged during routine SOC monitoring after exhibiting indicators of fraudulent behavior. VirusTotal analysis (13/95 detections as of analysis) confirms its stealthy nature, while registration details reveal it was created on March 26, 2026, through Web Commerce Communications Ltd. The domain resolves to IP 104.21.27.72 and utilizes a Let’s Encrypt SSL certificate—a tactic often leveraged to appear legitimate. Correlation with known phishing kits suggests this may be part of a broader campaign targeting Depop’s user base. If you’ve visited depop.order5315.cfd or entered credentials on the page, immediately reset your Depop password and enable two-factor authentication. Review recent orders for unauthorized activity and monitor linked payment methods for suspicious transactions. Contact Depop support via official channels to report the incident and request account review. Avoid clicking links in unsolicited emails or messages, as these often lead to similar phishing traps. Proactive verification of URLs—especially domains with randomized subpaths like order5315—remains critical to avoiding credential compromise.