dpd[.]mtrxqvlp[.]cfd

Analysis of the domain dpd.mtrxqvlp.cfd indicates that it was actively used in a generic phishing campaign before being taken offline. The site was hosted behind Cloudflare infrastructure and responded over HTTP/3, resolving to the IP address 104.21.17.135, which is registered to Cloudflare, Inc. in Canada. Registration details show the domain was created through Aceville Pte. Ltd., and no SSL certificate was observed for the host, leaving the connection unencrypted. The page title returned by the server matches the domain name itself, providing no additional context about the targeted brand or content.

Defensive feeds have recorded the domain on a single security blocklist, and it was explicitly blocked by the PhishDestroy service. Google Safe Browsing classifies the site as a social engineering threat, and Gridinsoft assigns it a trust score of zero out of one hundred, reflecting extreme risk. VirusTotal analysis recorded sixteen detections out of ninety‑one scanned security vendors, further confirming malicious intent.

Although the site is no longer reachable, the evidence suggests a high‑risk phishing operation that leveraged Cloudflare’s performance features to increase availability. Defenders should continue to monitor for any re‑registration of the domain or related subdomains, enforce blocklist updates to include dpd.mtrxqvlp.cfd, and consider network‑level filtering of its associated IP address. Threat hunters should also scrutinize traffic to Cloudflare edge nodes originating from the same IP range for potential repeat abuse, and update detection rules to flag HTTP/3 connections lacking TLS certificates when associated with suspicious registrars such as Aceville Pte. Ltd.