dpd[.]mtrqzplxvn[.]club

This domain, dpd.mtrqzplxvn.club, is flagged as a credential theft operation impersonating DPD, a recognized parcel delivery service. Analysis indicates the site mimics legitimate DPD login portals to harvest user credentials, likely targeting customers expecting package updates or delivery notifications. No crypto drainer kit signatures were detected, but the infrastructure aligns with credential harvesting campaigns observed in recent months, particularly those exploiting logistics brands during peak delivery periods. Infrastructure analysis reveals the domain resolves to IP address 104.21.67.163, a Cloudflare-protected endpoint utilizing HTTP/3 for obfuscation and performance. The domain was registered through Dominet (HK) Limited, a registrar frequently associated with malicious infrastructure. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious, while it appears on a single blocklist. The page title, dpd.mtrqzplxvn.club, further confirms the impersonation attempt, as legitimate DPD portals do not use subdomain-based branding in this manner. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, suggesting either recent takedown or evasion techniques. The domain is currently offline, likely following abuse reports or automated takedown procedures. However, residual risk remains elevated due to the transient nature of such infrastructure. Users who interacted with the site should assume credential exposure and initiate password resets for DPD accounts, as well as any reused credentials across other platforms. Organizations should monitor for follow-up campaigns using similar subdomain patterns (e.g., mtrqzplxvn.club) or DPD-themed lures, particularly via SMS or email. Network defenders are advised to block the IP 104.21.67.163 and monitor for related domains registered under Dominet (HK) Limited, as this registrar has been linked to multiple credential theft operations in the past 12 months.