dpd[.]vrmzqpxltn[.]cyou

This domain, dpd.vrmzqpxltn.cyou, is identified as a high-risk phishing site specifically designed to impersonate DPD, a well-known international parcel delivery service. Analysis indicates the threat falls under the generic_phishing category, where attackers leverage fake delivery notifications to deceive users into divulging personal information or login credentials. No evidence of a cryptocurrency drainer kit was observed, but the domain exhibits classic social engineering tactics, including the use of urgency and branded templates to manipulate victims. Infrastructure analysis reveals several critical technical indicators. The domain was registered through Dominet (HK) Limited on May 28, 2026, an unusual future date that may indicate attempts to evade detection or manipulate registration records. It resolves to the IP address 172.67.196.66, a Cloudflare-hosted endpoint, which is frequently exploited to mask malicious infrastructure. Security vendors flagged the domain in 10 out of 95 detections on VirusTotal, while Google Safe Browsing explicitly classifies it under SOCIAL_ENGINEERING. Additionally, the domain appears on one security blocklist and is actively blocked by enterprise-grade threat intelligence platforms. As of the latest assessment, dpd.vrmzqpxltn.cyou has been taken offline, likely in response to security interventions or registrar enforcement actions. However, the residual risk remains elevated due to the domain's recent activity and the potential for attackers to rapidly redeploy similar infrastructure under new domains. Users who interacted with this site should immediately revoke any shared credentials, monitor financial accounts for unauthorized activity, and verify delivery notifications through official channels. Organizations are advised to update blocklists with the domain and associated IP, while security teams should investigate logs for connections to 172.67.196.66 or related phishing campaigns.