dpd[.]mpxtrqlzvn[.]club

This domain, dpd.mpxtrqlzvn.club, operates as a parcel delivery credential phishing site designed to harvest login credentials, payment details, and personal information by impersonating legitimate logistics providers. Analysis indicates the infrastructure was specifically engineered to mimic parcel tracking portals, exploiting user trust in delivery notifications to facilitate unauthorized access to sensitive accounts. The campaign likely targets consumers awaiting shipments, leveraging urgency and familiarity to bypass security awareness defenses. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited and resolves to the IP address 104.21.29.247, a host commonly associated with ephemeral phishing operations. Detection metrics confirm elevated malicious activity, with 11 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, further corroborating its classification as a confirmed phishing threat. The SSL certificate, issued by Let's Encrypt, was likely deployed to lend superficial legitimacy to the fraudulent site, a tactic frequently observed in credential harvesting campaigns. Users who visited dpd.mpxtrqlzvn.club or entered credentials on the site should immediately revoke and reset any exposed login details, particularly for parcel delivery accounts, financial services, or email platforms. Monitor linked accounts for unauthorized transactions or modifications, and enable multi-factor authentication where available to mitigate further risk. If payment details were submitted, contact financial institutions to initiate fraud protocols and consider placing a credit freeze. System scans using updated security tools are recommended to detect potential secondary infections or data exfiltration artifacts.