dpd[.]mztrxplqvn[.]cfd

This domain, dpd.mztrxplqvn.cfd, is identified as a high-risk phishing site designed to impersonate DPD, a legitimate parcel delivery service. Analysis indicates the site presents a fake parcel tracking and login portal, likely intended to harvest user credentials or personal information under the guise of package delivery notifications. No specific crypto drainer kit signatures were detected, but the site employs standard phishing tactics to deceive victims into entering sensitive data. The domain mimics the branding and user interface of the authentic DPD service, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on May 26, 2026, through Aceville Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.152.11, which is protected by Cloudflare, a common tactic to obfuscate the true hosting origin and evade takedown efforts. The domain is flagged by Google Safe Browsing for SOCIAL_ENGINEERING, and 18 out of 95 security vendors on VirusTotal have detected it as malicious. Additionally, the domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. As of the latest assessment, dpd.mztrxplqvn.cfd has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the infrastructure remains a residual risk, as the domain could be reactivated or repurposed for future phishing campaigns. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for any resurgence of activity under the same registrar or hosting patterns. End users should verify the authenticity of parcel tracking links by accessing official DPD portals directly and avoid entering credentials on unsolicited or suspicious sites.