dpd[.]mpxtrqzlvn[.]club

This domain, dpd.mpxtrqzlvn.club, is identified as a phishing site impersonating DPD, a global parcel delivery service. The threat type is classified as a parcel scam phishing campaign, designed to deceive recipients into disclosing personal or financial information under the guise of delivery notifications or failed shipment alerts. As of the latest verification, the domain has been taken offline, though residual risks may persist due to cached or mirrored instances. Analysis indicates the domain was flagged by 21 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence platforms. Infrastructure analysis reveals the domain resolves to the IP address 172.67.141.15, a Cloudflare-hosted endpoint leveraging HTTP/3 for content delivery. The domain was registered through Dominet (HK) Limited, a registrar frequently associated with high-risk or transient domains. It appears on at least one security blocklist, further corroborating its malicious classification. No creation date was provided, but the use of Cloudflare and the domain structure suggest recent deployment, likely within the last 30 days. Current status confirms the domain is offline, though threat actors may reactivate or migrate the campaign to alternative infrastructure. Organizations and individuals are advised to implement DNS-based blocking for 172.67.141.15 and monitor for domains with similar naming patterns (e.g., randomized subdomains under .club TLDs). End-users should be trained to verify sender domains in parcel notifications and avoid interacting with unsolicited delivery links. Security teams are recommended to review logs for connections to 172.67.141.15 and correlate with known DPD-themed phishing indicators.