dpd[.]plztrqvxmn[.]cfd

This domain, dpd.plztrqvxmn.cfd, is flagged as a high-risk phishing resource specializing in parcel delivery fraud. Analysis indicates the site employs social engineering tactics to deceive users into divulging sensitive information or downloading malicious payloads under the guise of legitimate package tracking services. The threat type is classified as generic phishing with a focus on impersonating logistics providers, a common vector for credential theft and financial fraud. Infrastructure analysis reveals the domain was registered through Aceville Pte. Ltd. on May 28, 2026, an anomalous creation date suggesting potential domain spoofing or pre-registration for malicious use. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare’s network, a frequent choice among threat actors to obfuscate hosting origins and complicate takedown efforts. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly categorizes it under SOCIAL_ENGINEERING. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Technologies detected include Cloudflare and HTTP/3, further indicating an attempt to leverage modern web protocols for evasion. To mitigate risks associated with this threat, users should avoid interacting with any communications or links referencing dpd.plztrqvxmn.cfd. Organizations are advised to implement DNS-based blocking for the domain and its associated IP address, 188.114.96.3, at the network perimeter. Endpoint protection systems should be updated to recognize the domain’s signatures, and security teams should monitor for indicators of compromise, such as unexpected redirects or credential submission attempts. Given the domain’s registration through a less-regulated registrar, proactive monitoring of newly registered domains with similar patterns is recommended to preempt future campaigns.