dpd[.]vlqztrmxpn[.]cloud

This domain is flagged as a high-risk brand impersonation phishing site designed to mimic DPD, a legitimate parcel delivery service. Analysis indicates the infrastructure is actively used for credential harvesting or fraudulent parcel fee collection, a common tactic in logistics-themed phishing campaigns. Infrastructure analysis reveals the domain dpd.vlqztrmxpn.cloud resolves to IP address 188.114.97.3 (AS13335, Cloudflare, Inc.) with no SSL certificate present. VirusTotal reports 9 out of 95 security vendors detecting the domain as malicious. Registered through Dominet (HK) Limited on May 27, 2026, the domain appears on one security blocklist and is currently active. The page title matches the domain name exactly, a red flag for cloned or spoofed login portals. Notably, the creation date is in the future, suggesting domain registration data manipulation to evade detection. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (188.114.97.3) at network perimeter controls. Organizations should implement DMARC, DKIM, and SPF policies to prevent email spoofing of DPD domains. End-users should be trained to verify parcel notifications via official DPD channels only, checking for HTTPS and valid certificates before entering credentials. Security teams should monitor for connections to 188.114.97.3 and correlate with phishing alert logs for potential credential compromise incidents.