autodiscover[.]qatarairways-contract[.]com

Analysis of autodiscover.qatarairways-contract.com indicates an active credential-phishing domain targeting corporate users. Registered through INWX GmbH, the domain remains operational as of July 25, 2026, with a 302 HTTP redirect status, suggesting it may forward visitors to a secondary malicious endpoint. Infrastructure is hosted on nameservers ns19.truehostdns.com and ns20.truehostdns.com, a configuration previously observed in phishing campaigns.

Six of 91 security vendors on VirusTotal have flagged the domain, while PhishDestroy has already blocked it, and it appears on one additional security blocklist. The domain name incorporates 'autodiscover' and 'qatarairways,' a pattern commonly exploited to impersonate enterprise email services or airline-related communications, though no page content or phishing kit has been confirmed in this assessment. Defenders should treat this domain as high-risk and prioritize blocking at DNS, proxy, and endpoint layers.

Network logs should be reviewed for connections to the domain or its nameservers, and affected users should be directed to reset credentials through official channels. Further investigation is required to determine the final landing page, payload delivery mechanisms, and any associated command-and-control infrastructure.