dpd[.]mqtrplxzvn[.]cloud

PhishDestroy has identified dpd.mqtrplxzvn.cloud as a malicious phishing domain targeting users of the parcel delivery service DPD. This domain is part of a broader campaign that uses deceptive landing pages to harvest sensitive personal and financial information. No specific drainer kit was identified, but the site's design and behavior are consistent with credential theft.

The domain has a VirusTotal detection rate of 10 out of 95 security vendors, indicating significant malicious consensus. It was registered through Dominet (HK) Limited and resolves to the IP address 188.114.97.3, hosted on Cloudflare infrastructure. The domain was created on May 27, 2026, a remarkably recent date that underscores its transient nature. Google Safe Browsing flags the site as phishing, and it appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, which is a common red flag for phishing sites.

As of the latest check, dpd.mqtrplxzvn.cloud is offline. This takedown may be the result of a hosting provider suspension, registrar intervention, or law enforcement action. However, given the short lifespan and rapid registration, the threat actors likely have multiple similar domains ready for deployment. Users who may have visited the site are advised to change passwords and monitor accounts for suspicious activity. PhishDestroy recommends avoiding interaction with unsolicited delivery notifications and verifying tracking URLs through official DPD channels.