dpd[.]vrqtplmnxz[.]cfd

This domain, dpd.vrqtplmnxz.cfd, is identified as a credential theft operation impersonating DPD, a global parcel delivery service. Analysis indicates the site presents fraudulent delivery notifications to trick recipients into entering sensitive account credentials or payment details. No cryptocurrency drainer kit signatures were observed, but the infrastructure aligns with credential harvesting campaigns targeting logistics brands. Infrastructure analysis reveals the domain was registered through Aceville Pte. Ltd. on May 28, 2026, with a creation date far beyond the current timeline, suggesting domain age manipulation or registry data falsification. It resolves to IP address 172.67.195.21, hosted behind Cloudflare with HTTP/3 support. Google Safe Browsing flags the domain under the SOCIAL_ENGINEERING category, and VirusTotal reports detection by 19 out of 95 security vendors. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. The domain is currently offline, likely following takedown actions or automated blocking by security providers. Despite its inactive status, residual risk remains due to potential reuse of the infrastructure or distribution through cached links in phishing emails. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse attempts from affected users, and verify delivery notifications through official DPD channels only. The use of Cloudflare and HTTP/3 indicates an attempt to evade detection and improve page load performance, underscoring the need for layered security controls.