dpd[.]mplvqxtrzn[.]cfd

This domain, dpd.mplvxtrzn.cfd, is identified as an active phishing site specifically designed to impersonate DPD, a well-known international parcel delivery service. Analysis indicates the site employs a fake login portal to harvest user credentials, likely targeting customers expecting legitimate delivery notifications. No evidence of a crypto drainer kit or direct financial malware was observed, but the credential harvesting mechanism poses significant risk to personal and corporate data security. The domain exhibits classic brand impersonation tactics, including a deceptive subdomain structure mimicking official DPD communication channels. Infrastructure analysis reveals critical technical indicators associated with this threat. The domain resolves to IP address 104.21.13.230, hosted on Cloudflare infrastructure (AS13335), a common obfuscation tactic used to conceal the true origin of malicious sites. It was registered through Aceville Pte. Ltd. on May 28, 2026, an unusually forward-dated registration that may indicate automated domain generation or intentional misdirection. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. The domain appears on one security blocklist, and no SSL certificate is present, further reducing user trust indicators. As of the latest assessment, dpd.mplvxtrzn.cfd remains active and accessible, posing an ongoing threat to unsuspecting users. The site has been flagged by multiple threat intelligence platforms, though no takedown action has been confirmed. The use of Cloudflare hosting complicates mitigation efforts, as the true backend infrastructure remains obscured. Users are advised to avoid interacting with any communications or links associated with this domain, particularly those referencing DPD delivery updates or account access. Organizations should update web filtering policies to block the domain and its associated IP, and monitor for credential reuse attempts from compromised accounts. The high-risk classification is maintained due to the active status, brand impersonation, and confirmed credential harvesting activity.