dpd[.]mxqtrpv[.]cfd

This domain, dpd.mxqtrpv.cfd, operates as a credential theft site impersonating the legitimate parcel delivery service DPD. The site presents visitors with fraudulent login pages designed to harvest usernames and passwords, which can then be exploited for unauthorized account access, financial fraud, or further phishing campaigns. The use of a well-known brand increases the likelihood of successful deception, particularly among users expecting package delivery notifications. Analysis indicates this domain was registered on May 29, 2024, through Aceville Pte. Ltd., a registrar frequently associated with high-risk domains. The site resolves to the IP address 188.114.96.3 and is flagged by 18 out of 95 security vendors on VirusTotal, with additional detections on two security blocklists. The infrastructure leverages Cloudflare and HTTP/3, which may obscure the true origin of the malicious content and complicate takedown efforts. The domain's creation date aligns with recent surges in parcel delivery-themed phishing campaigns. If a user visited dpd.mxqtrpv.cfd and entered credentials, they should immediately change the passwords for any accounts using the same or similar login details. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any fraudulent incidents to the legitimate service provider. Users should also scan their devices for malware, as credential theft sites may deploy additional payloads. Avoid interacting with any communications claiming to be from DPD that request personal or financial information.