dpd[.]ch-postl[.]com

Analysis indicates that the domain dpd.ch-postl.com is actively flagged as a high-risk phishing site targeting Swiss courier services. The domain was registered on May 17, 2026, through Aceville Pte. Ltd., and currently resolves to the IP address 84.32.59.217, hosted by Tusker Technologies Pty Ltd in Germany. Infrastructure analysis reveals the use of nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com, a configuration often associated with domains leveraging DNSPod’s DNS services for rapid deployment and evasion. The page title, 'Paketdienst Schweiz | DPD Schweiz,' explicitly suggests an attempt to impersonate a legitimate Swiss parcel delivery service, though no direct evidence confirms the exact visual or functional mimicry of the official site. Google Safe Browsing has classified this domain under 'SOCIAL_ENGINEERING,' a designation typically applied to pages designed to deceive users into divulging credentials or sensitive information. The domain is also present on at least one security blocklist and is actively blocked by PhishDestroy. SSL certification is provided by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its accessibility and automation. The HTTP status code 308 (Permanent Redirect) may indicate an attempt to funnel users to another destination, though the target of this redirect has not been confirmed. While 21 of 91 security vendors on VirusTotal have flagged this domain, the absence of additional context limits conclusions about the specific payload or attack vector. Defenders should treat this domain as an active threat. Network-level blocking of the IP 84.32.59.217 and the domain itself is recommended, alongside monitoring for related subdomains or newly registered lookalike domains. Further investigation into the redirect chain and any associated infrastructure may reveal additional compromised or malicious assets.