dpd[.]qvxtrzlmnp[.]cfd

This domain, dpd.qvxtrzlmnp.cfd, is flagged as a high-risk phishing resource specializing in parcel delivery credential harvesting. Analysis indicates the site employs social engineering techniques to deceive users into disclosing sensitive login credentials, payment details, or personal information under the guise of a legitimate delivery notification. The threat type is classified as generic_phishing with a specific focus on impersonating logistics providers, a tactic commonly observed in fraudulent parcel tracking scams. Infrastructure analysis reveals the domain was registered on May 28, 2026, through Aceville Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.20.57, which is part of a content delivery network known for obscuring origin servers. Detection metrics show the domain is flagged by 15 out of 95 security vendors on a prominent malware analysis platform, while appearing on two independent security blocklists. Additional protective measures include blocking by two specialized anti-phishing systems and a Google Safe Browsing classification of SOCIAL_ENGINEERING. The site employs HTTP/3 and Cloudflare technologies, which are often leveraged to evade detection and enhance performance. Mitigation of this threat requires immediate domain blacklisting across enterprise and consumer security systems. Network administrators should implement DNS-based blocking for 104.21.20.57 and monitor for related subdomains under the qvxtrzlmnp.cfd parent domain. End users should be educated to verify sender domains in parcel delivery notifications and avoid entering credentials on untrusted sites. Organizations are advised to enforce multi-factor authentication for logistics portals to neutralize the impact of stolen credentials. Given the domain's current offline status, continuous monitoring for reactivation or domain rebranding is recommended.