dpd[.]rqxplmvztn[.]cyou

This domain is flagged as a high-risk parcel delivery phishing site, designed to deceive users into disclosing logistics account credentials or payment details under false pretenses. Analysis indicates the infrastructure mimics legitimate courier services, leveraging social engineering techniques categorized under SOCIAL_ENGINEERING by Google Safe Browsing. The threat specifically targets individuals expecting package deliveries, exploiting trust in recognized brand names to facilitate credential harvesting or financial fraud. Infrastructure analysis reveals the domain dpd.rqxplmvztn.cyou was registered on May 28, 2026, through Dominet (HK) Limited, a registrar frequently associated with abusive domains. The site resolves to IP address 172.67.145.26, protected by Cloudflare’s network, and employs HTTP/3 for enhanced performance and evasion. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title, identical to the domain name, lacks legitimate branding, further indicating its fraudulent nature. Current status confirms the site has been taken offline, though residual risks persist for users who may have interacted with it prior to deactivation. Mitigation requires immediate action from network administrators and end-users. Organizations should block the domain and its resolving IP (172.67.145.26) at the perimeter firewall and DNS levels to prevent access. Users who visited the site should reset credentials for any logistics or financial accounts, particularly if identical passwords were reused. Security teams are advised to monitor for indicators of compromise, including unusual login attempts or unauthorized transactions, and deploy email filtering rules to quarantine messages referencing parcel delivery themes. Given the domain’s recent creation and registrar history, proactive threat hunting for similar infrastructure (e.g., domains registered via Dominet (HK) Limited with courier-related keywords) is recommended to disrupt emerging campaigns.