Phishing sites impersonating Correos

PhishDestroy has recorded 10 phishing domains impersonating Correos since 2025-11-27, 3 of them in the last 30 days. The most used registrars are NameCheap and Domain.com; the most common TLDs are .com and .me. Open Correos only from its official app or a saved bookmark.

10
Domains, all time
3
Last 30 days
5
Online at last check
0
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 12026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 32026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Correos phishing domains detected per day: 4 from 2026-07-25 to 2026-10-22; peak 3.

How to tell a fake Correos site

Words most often added to the brand in reported domains: anconaresidencial, mybluehost, entrega, correogoparcelconnecthub, correosparcelconnect, accounts, caf, bcv, nxk, slj.

  • Type the address yourself or use a bookmark; phishing links for Correos arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Correos does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Correos phishing domains

The 10 most recently detected domains impersonating Correos
DomainFirst detectedStatus at last checkRegistrar
correos-entrega.naiwniak.pl2026-09-26Onlinehome.pl sp. z o.o
bremgartener-goldschmiede.de2026-09-26Online—
correos-entrega.slodkibox.pl2026-09-26Onlinehome.pl sp. z o.o
e.vg2026-08-05Onlinehttps://www.101domain.com/
easybkk.ch2026-06-26Offline—
nxk.slj.mybluehost.me2026-04-02OfflineDomain.com
caf.bcv.mybluehost.me2026-03-14OnlineDomain.com
correos.es-accounts.es2026-02-20Offline—
correosparcelconnect.anconaresidencial.com2025-11-30OfflineNameCheap
correogoparcelconnecthub.anconaresidencial.com2025-11-27OfflineNameCheap

All 10 Correos reports

Where they are registered and hosted

Registrars

  1. NameCheap2
  2. Domain.com2
  3. home.pl sp. z o.o2
  4. https://www.101domain.com/1

Top-level domains

  1. .com2
  2. .me2
  3. .pl2
  4. .es1
  5. .ch1
  6. .vg1
  7. .de1

Hosting networks

  1. NAMECHEAP-NET, US2
  2. Oracle Corporation2
  3. Kraken Network ISP LTD1
  4. SWIZZONIC-AS swizzonic ltd, CH1
  5. Cloudflare, Inc.1
  6. dogado GmbH1
  7. Joseph Hofmann trading as 'Tornado Datacenter Gm1
  8. DigitalOcean, LLC1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Correos; share of all PhishDestroy reports: 0.00%.