dpd[.]mzqrvtplxn[.]cfd

This domain, dpd.mzqrvtplxn.cfd, is flagged as a high-risk credential theft operation impersonating a logistics delivery service. Analysis indicates the site was designed to harvest user login credentials, payment details, or personal information under the guise of a legitimate parcel tracking or customer support portal. The domain does not exhibit indicators of a crypto drainer kit or direct financial transaction interception, focusing instead on traditional credential harvesting techniques. No specific brand logo misuse was confirmed, but the naming convention strongly suggests an intent to mimic a recognized logistics provider, likely exploiting user trust in delivery-related communications. Infrastructure analysis reveals the domain was registered through Aceville Pte. Ltd. on May 28, 2026, resolving to the IP address 188.114.96.3. Detection metrics include a VirusTotal score of 17/95, with Google Safe Browsing categorizing the threat as SOCIAL_ENGINEERING. The domain appears on one security blocklist, and additional telemetry confirms the use of Cloudflare for hosting and HTTP/3 for network communication. The creation date discrepancy—registered in 2026—suggests either a typographical error in registration records or an attempt to obfuscate the true timeline of the campaign. The domain is currently offline, likely as a result of takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains due to the potential for credential reuse by threat actors who may have already exfiltrated sensitive data. Users who interacted with the site are advised to reset passwords for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor financial statements for unauthorized activity. Organizations should update security policies to block the domain and its associated IP address in perimeter defenses, while also conducting retrospective log analysis to identify potential compromise indicators.