dhlexpress[.]bg

The domain dhlexpress.bg is currently flagged as an active delivery‑scam infrastructure with a high risk rating. DNS resolution points to the single IPv4 address 81.95.110.236, and the authoritative name servers are ns1.f5clouddns.com and ns2.f5clouddns.com. Threat intelligence sources have placed the domain on one public security blocklist, and PhishDestroy has recorded it as blocked. VirusTotal analysis shows that eight of ninety‑one scanned security vendors identified malicious indicators associated with the domain, confirming that multiple independent detection engines consider the host suspicious. The domain remains active as of the report date, July 27 2026, and no evidence of takedown or remediation has been observed.

The available data does not disclose the hosting provider, ASN, or any SSL/TLS certificate details, leaving those aspects of the infrastructure unverified. Likewise, there is no publicly released page title or evidence of specific brand impersonation beyond the generic delivery‑scam classification, so the exact luring technique employed by the site cannot be fully described. Analysts should treat the lack of additional context as a gap that may be filled by future passive DNS or active probing.

Defensive actions are clear: network operators should add dhlexpress.bg and its resolved IP 81.95.110.236 to perimeter deny lists, and security appliance signatures that reference the observed nameservers or the eight vendor detections should be updated. Traffic monitoring for outbound connections to the IP is advisable to detect potential compromised hosts within an organization. Because the domain is already on a blocklist, aggregating its indicators into local threat feeds will improve early warning capability. Continuous re‑evaluation is recommended, as further resolution changes or additional vendor detections could increase the threat surface.