dhl[.]pl[.]qas[.]edistrada[.]pl

Analysis of dhl.pl.qas.edistrada.pl shows a high‑risk delivery‑scam infrastructure that remains active as of July 2026. The domain was registered on 15 September 2011 through OVH SAS and continues to resolve to the IPv4 address 91.206.38.179. Authoritative name servers are ns1.clouddc.eu, ns2.clouddc.eu, and ns3.clouddc.eu, indicating the use of a cloud‑based DNS provider. VirusTotal reports that 16 of 91 security scanners have flagged the domain, providing independent confirmation of malicious activity. No additional public intelligence, such as sample payloads or phishing page content, is currently available, so the exact delivery‑scam vector (e.g., fake courier notifications or malicious attachments) cannot be confirmed. Defenders should block traffic to the domain and its resolving IP at network perimeters, monitor DNS queries for the three clouddc.eu name servers, and add the domain to indicator‑of‑compromise (IOC) lists. Continuous re‑scanning of the domain on multiple sandboxes is recommended to capture any evolving payloads, and incident response teams should treat any communications referencing DHL delivery as potentially fraudulent when associated with this domain.