dpd[.]mtrqplxzvn[.]club

This domain, dpd.mtrqplxzvn.club, is flagged as a generic phishing threat targeting parcel delivery services, specifically impersonating DPD logistics. Analysis indicates the site employs social engineering tactics, likely presenting itself as a legitimate parcel tracking portal to deceive users into entering sensitive information such as login credentials, payment details, or personal data. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the domain is registered through Dominet (HK) Limited and resolves to the IP address 104.21.3.20. It is detected by 17 out of 95 security vendors on VirusTotal, appearing on at least one security blocklist. The domain employs Cloudflare for hosting and utilizes HTTP/3, which may complicate detection and takedown efforts. The creation date is not explicitly provided in available intelligence, but the domain is currently categorized as offline. Google Safe Browsing (GSB) status is not disclosed, though the presence on a single blocklist suggests limited but targeted detection. As of the latest assessment, dpd.mtrqplxzvn.club has been taken offline, likely following abuse reports or registrar intervention. However, the elevated risk level persists due to the domain's recent activity and the potential for re-registration or migration to alternative infrastructure. Users who interacted with the domain are advised to monitor for unauthorized account access, particularly in relation to parcel delivery services. Organizations should update blocklists to include the domain and associated IP, and conduct retrospective log analysis to identify any prior compromise attempts. The use of Cloudflare and HTTP/3 indicates a degree of sophistication, warranting continued vigilance for similar threats.