dpd[.]xnrqtpvlzm[.]cyou

This domain, dpd.xnrqtpvlzm.cyou, is actively engaged in a phishing campaign designed to mimic legitimate parcel delivery notifications. The site specifically targets users expecting package updates, tricking them into entering sensitive credentials or financial details under the guise of resolving delivery issues or paying customs fees. Analysis indicates the threat is highly deceptive, leveraging familiar branding and urgent messaging to lower user vigilance. The infrastructure is optimized for rapid deployment and evasion, making it a persistent risk to unsuspecting recipients of fraudulent delivery alerts. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on May 27, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.145.39, hosted on AS13335 (Cloudflare, Inc.), which is commonly used to obfuscate the true origin of phishing sites. Security vendors have flagged the domain as malicious, with 10 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has explicitly marked it as a phishing site. Notably, the absence of an SSL certificate further undermines any pretense of legitimacy, as modern browsers flag such sites as insecure. Users who have visited dpd.xnrqtpvlzm.cyou or interacted with its content should take immediate action to mitigate potential risks. First, any credentials entered on the site must be considered compromised and should be changed immediately across all platforms where they were reused. Affected users should also monitor financial accounts for unauthorized transactions and report any suspicious activity to their financial institutions. Running a full system scan with updated security software is recommended to detect any secondary payloads or malware that may have been delivered. Finally, users should report the domain to their email provider or IT security team to prevent further exposure within their network. Vigilance against follow-up phishing attempts, particularly those referencing parcel deliveries or urgent account actions, is strongly advised.