dpdgroup[.]05049[.]work

This domain, dpdgroup.05049.work, operates as a brand impersonation phishing site designed to deceive users into believing they are interacting with a legitimate parcel delivery service. The infrastructure mimics trusted logistics platforms, likely presenting fake tracking pages, payment portals, or account login forms to harvest credentials or financial information. The absence of an SSL certificate and the use of generic server responses (e.g., "Welcome to nginx!") further indicate a hastily deployed, low-effort malicious operation targeting unsuspecting victims expecting package updates. Analysis of the domain reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. It resolves to the IP address 104.21.88.91, hosted on Cloudflare’s network (AS13335), which is commonly exploited to obfuscate origin servers. VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. Google Safe Browsing has also classified the domain as phishing, reinforcing its fraudulent nature. Users who visited dpdgroup.05049.work should take immediate remedial action. If credentials or payment details were entered, affected accounts must be secured by resetting passwords and enabling multi-factor authentication. Financial institutions should be notified to monitor for unauthorized transactions. Devices used to access the site should undergo a full malware scan, as phishing pages may deploy additional payloads. Future vigilance is advised when interacting with unsolicited parcel notifications, particularly those directing users to unfamiliar domains or requesting sensitive information.