test[.]dhl-express-ppd[.]infanion[.]com

Analysis of test.dhl-express-ppd.infanion.com indicates the domain is currently offline and was created on 21 February 2026. The domain resolves to the IP address 52.19.172.57, which is assigned to AS16509 operated by Amazon.com, Inc. and geolocated to Ireland. Registration was performed through GoDaddy.com, LLC and the authoritative name servers are ns67.domaincontrol.com and ns68.domaincontrol.com. An active TLS certificate issued by Let’s Encrypt (E6) is present, confirming that HTTPS connections were available before the offline status.

The web server returned HTTP 502, and the page title captured was "Login | DHL Express RPA portal", matching the declared brand target DHL. Technology fingerprinting identified Drupal, PHP, Ubuntu, Bootstrap, Nginx, Slick, reCAPTCHA and jQuery, suggesting a typical content‑management stack. VirusTotal reports 16 of 93 scanners flagging the domain, demonstrating moderate detection across security vendors. The domain is listed on one public blocklist and has been actively blocked by PhishDestroy.

Taken together, the evidence supports a brand‑impersonation campaign aimed at harvesting DHL credentials. Uncertainty remains regarding the specific phishing payload, command‑and‑control infrastructure, or any exfiltration activity, as no additional intelligence such as OTX tags or Safe Browsing entries are available. Defenders should add the domain and its associated IP address to blocklists, enforce DNS sink‑hole rules, monitor for traffic to the IP range owned by Amazon in Ireland, and inspect any outbound connections from internal users that attempt TLS handshakes with the Let’s Encrypt certificate fingerprint. Continuous re‑scanning of the domain is recommended in case it becomes active again.