dpd[.]rqtxmvl[.]cfd

This domain, dpd.rqtxmvl.cfd, poses a high-risk credential theft threat by impersonating DPD, a well-known parcel delivery service. The site is designed to deceive users into entering sensitive login credentials, payment details, or personal information under the guise of tracking a package or resolving a delivery issue. Analysis of the domain reveals tactics consistent with large-scale phishing operations targeting e-commerce and logistics customers, particularly during peak delivery periods when users are more likely to expect parcel notifications. Infrastructure analysis reveals the domain was registered on May 29, 2026, through Aceville Pte. Ltd., a registrar frequently associated with malicious domains. The domain resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), which is commonly used to obfuscate the true origin of phishing infrastructure. Security vendors have flagged the domain as malicious, with 12 out of 95 engines on VirusTotal detecting it as phishing. Additionally, the domain appears on one security blocklist and is actively blocked by enterprise threat intelligence feeds. Notably, the site lacks an SSL certificate, which is unusual for legitimate services and further indicates its fraudulent nature. Users who have visited dpd.rqtxmvl.cfd or interacted with its content should take immediate action to mitigate potential compromise. First, reset any credentials entered on the site, particularly those associated with DPD accounts, email services, or financial platforms. Monitor accounts for unauthorized transactions or suspicious activity, and enable multi-factor authentication where available. If payment details were submitted, contact financial institutions to report potential fraud and request card replacements. Organizations should update internal blocklists to include this domain and its associated IP address, and conduct user awareness training to highlight the risks of impersonation attacks targeting delivery services.