dpd[.]verifyi[.]xyz

This domain is flagged as a high-risk credential phishing threat specifically designed to impersonate DPD, a legitimate parcel delivery service. The site presents a fake login page to harvest user credentials, posing significant risks to individuals and organizations relying on DPD for shipping communications. Analysis indicates a targeted campaign aimed at stealing account access for potential follow-up fraud or unauthorized package redirection. Infrastructure analysis reveals the domain dpd.verifyi.xyz was registered on May 27, 2026, through Aceville Pte. Ltd., a registrar frequently associated with malicious domains. The site resolves to IP address 188.114.97.3, hosted on AS13335 Cloudflare, Inc., a common obfuscation tactic to mask origin infrastructure. No SSL certificate is present, increasing the likelihood of interception or manipulation of submitted data. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 19 out of 95 security vendors detecting the domain as malicious, with detections spanning credential theft and brand impersonation categories. Mitigation requires immediate action to prevent credential compromise. Users who may have interacted with the domain should reset passwords for any accounts entered on the site, prioritizing accounts linked to DPD or other delivery services. Organizations should block the domain and its resolving IP at the network perimeter and monitor for internal traffic attempting to reach it. Security teams are advised to review logs for connections to 188.114.97.3 and correlate with authentication events. Employee training should reinforce identification of fake login pages, particularly those mimicking delivery services, and emphasize verification of domain legitimacy before entering credentials.