dpd[.]parceldirect[.]cfd

PhishDestroy has flagged dpd.parceldirect.cfd as an active crypto drainer impersonating DPD, a legitimate parcel delivery service. This domain is currently under investigation but remains a high-risk threat due to its malicious infrastructure and deceptive branding. Users interacting with this site risk unauthorized cryptocurrency transfers through malicious smart contracts or credential theft disguised as DPD shipping confirmations.

This domain was registered through Aceville Pte. Ltd. on March 26, 2026, and resolved to IP address 104.21.64.111, hosted on Cloudflare infrastructure with a valid Let’s Encrypt SSL certificate. VirusTotal currently shows 0 detections out of 95 scanners, indicating it has evaded standard antivirus detection. The domain’s recent creation date and low trust scores across threat intelligence platforms suggest it was deployed specifically for phishing campaigns. Despite its clean SSL certificate and hosting provider, the absence of detections highlights the sophistication of modern crypto drainers, which often bypass traditional security measures.

To mitigate risk, users should avoid entering any personal or financial information on dpd.parceldirect.cfd or clicking suspicious links claiming to be from DPD. Verify the legitimacy of shipping notifications by visiting the official DPD website directly. If a parcel notification seems unusual, cross-check the tracking number on DPD’s official portal. Report this domain to PhishDestroy to help block future attacks. Organizations should also monitor network traffic for connections to 104.21.64.111 and update security policies to flag domains with recent registration dates or low trust scores. Crypto drainers often exploit urgency (e.g., failed delivery notices) to trick users—always pause and verify before acting.