dpd[.]rqtxmvp[.]cfd

This domain, dpd.rqtxmvp.cfd, is identified as a phishing site impersonating DPD parcel delivery services. Analysis indicates the threat type is generic phishing, designed to harvest login credentials, payment details, or personal information from unsuspecting users expecting legitimate parcel notifications. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with credential theft campaigns targeting logistics and delivery service customers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335). It lacks an SSL certificate, increasing the risk of unencrypted data interception. The domain was registered on May 29, 2024, through Aceville Pte. Ltd., and is currently flagged by Google Safe Browsing as phishing. VirusTotal reports 13 out of 95 security vendors detecting this domain as malicious, while it appears on one additional security blocklist. Notably, the domain's creation date suggests recent deployment, aligning with common phishing campaign timelines. As of the latest verification, dpd.rqtxmvp.cfd remains active and continues to pose a high risk to users. Immediate response actions include blocking the domain at the DNS level and implementing network-level protections to prevent access. Users who may have interacted with this domain are advised to reset credentials for any associated accounts, monitor for unauthorized transactions, and report the incident to relevant financial institutions. The absence of SSL encryption and the use of Cloudflare hosting further complicate mitigation efforts, as these factors are frequently exploited to evade detection and prolong campaign effectiveness.