dpd[.]tvqrmplnzx[.]icu

PhishDestroy has identified dpd.tvqrmplnzx.icu as a high-risk phishing domain specifically targeting DPD customers. This threat is not a generic phishing campaign but a tailored attempt to steal login credentials and personal information by mimicking the legitimate DPD parcel tracking interface. The domain was taken offline shortly after discovery, but its infrastructure remains a concern.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports that 18 out of 95 security vendors flag this domain as malicious, and Google Safe Browsing specifically marks it for phishing. The domain was registered on May 28, 2026 through Dominet (HK) Limited, a registrar often associated with high-risk domains. It resolves to IP address 172.67.170.134, which is linked to Cloudflare's CDN, commonly used to obfuscate the true hosting location. No SSL certificate was issued, meaning any data transmitted would be unencrypted. The domain currently appears on 1 security blocklist, and its page title simply repeats the domain name—a common tactic to avoid detection.

Users who may have interacted with this domain should immediately change any passwords entered and enable two-factor authentication on affected accounts. Monitor financial accounts for unauthorized transactions and report any suspicious activity to DPD's official support channels. As a proactive measure, ensure that browser and security software are up to date, and consider using a password manager to avoid reusing credentials. PhishDestroy recommends blocking the domain at the network level and adding the IP 172.67.170.134 to threat intelligence feeds to prevent future contact.