kangur-przeprowadzki[.]pl

Analysis as of August 03, 2026 indicates that the domain kangur-przeprowadzki.pl was registered on August 02, 2026 through Aftermarket.pl Limited and is currently resolving to the IP address 188.210.221.221. The domain is delegated to the authoritative name servers ns1.seohost.pl and ns2.seohost.pl. It appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that it is being used for malicious purposes. VirusTotal records show that the domain has been examined by 91 scanning engines, none of which reported a detection at the time of analysis; this lack of detection does not constitute a validation of safety, as the content has not been publicly disclosed.

No public evidence has been identified regarding the site’s SSL certificate, HTTP response headers, page title, or any specific branding employed in the phishing lure, so the exact visual or functional characteristics remain unknown. The limited telemetry suggests a typical short‑lived phishing operation, with the rapid creation‑to‑activation window of one day. Defenders should add 188.210.221.221 to network‑level block lists, monitor DNS queries for the domain and its name servers, and enforce existing URL filtering policies that include the PhishDestroy feed.

Continuous re‑scanning on VirusTotal and other sandbox services is advised to capture any payload or page changes. Organizations that process Polish logistics or moving‑service communications should be especially vigilant, as the domain name appears to reference a moving company. Until further forensic evidence is obtained, the domain should be treated as malicious and blocked.