support-mydpd-de[.]looksel[.]com

This domain, support-mydpd-de.looksel.com, is identified as a credential theft operation impersonating DPD logistics services. Analysis indicates the site was designed to harvest user login credentials through fraudulent parcel tracking or delivery notification pages, a common tactic in logistics-themed phishing campaigns. The domain name incorporates the legitimate DPD brand identifier 'mydpd-de', increasing its likelihood of deceiving users expecting communications from the courier service. No specific drainer kit signatures were observed, but the exposed directory listing suggests poor operational security, potentially revealing backend scripts or stolen data storage locations. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered through GoDaddy.com, LLC on February 19, 2015, though the malicious use appears recent based on detection patterns. It resolves to IP address 162.240.174.198, which has been flagged by 10 of 95 security vendors on VirusTotal. The Apache HTTP Server technology detected serves an exposed directory listing titled 'Index of /', a misconfiguration that may have facilitated detection. The domain appears on one security blocklist and was proactively blocked by at least one enterprise-grade filtering system. Current status shows the domain has been taken offline, likely following detection and reporting. While the immediate threat has been mitigated, residual risk remains due to the domain's long-standing registration and potential reuse of the infrastructure. Organizations should monitor for similar domains using the 'looksel.com' parent domain or the same IP range. Users who interacted with the site should immediately reset credentials for any logistics or delivery services, particularly DPD accounts. The exposed directory listing suggests possible compromise of stored credentials, warranting enhanced monitoring for account takeover attempts.