dpd[.]dpdccav[.]cfd

The domain dpd.dpdccav.cfd is involved in a high-risk brand impersonation phishing attack, currently taken offline. The specific threat type is brand impersonation, likely targeting the DPD brand to deceive users into providing sensitive information.

Infrastructure analysis reveals that the domain is registered through Dynadot LLC and resolves to the IP address 43.165.0.236. It was created on May 28, 2026. The domain is flagged by 19 out of 95 security vendors on VirusTotal and appears on one security blocklist. The page title for the domain is dpd.dpdccav.cfd, and it has been identified as a SOCIAL_ENGINEERING threat by Google Safe Browsing. The domain uses Nginx as its web server and has HSTS enabled, which can complicate the detection of phishing activities.

Given the current status of the domain being taken offline, it is recommended that network administrators and security teams continue to monitor for any signs of reactivation. Additionally, users should be educated about the risks of brand impersonation phishing and advised to verify the legitimacy of websites through official channels. Organizations should also consider updating their security policies to include specific guidelines for identifying and reporting such threats.