# Phishing sites impersonating Correos

PhishDestroy has recorded 10 phishing domains impersonating Correos since 2025-11-27, 3 of them in the last 30 days. The most used registrars are NameCheap and Domain.com; the most common TLDs are .com and .me. Open Correos only from its official app or a saved bookmark.

10Domains, all time

3Last 30 days

5Online at last check

0Confirmed takedowns

## New domains in the last 90 days

Correos phishing domains detected per day: 4 from 2026-07-25 to 2026-10-22; peak 3.

## How to tell a fake Correos site

Words most often added to the brand in reported domains: anconaresidencial, mybluehost, entrega, correogoparcelconnecthub, correosparcelconnect, accounts, caf, bcv, nxk, slj.
- Type the address yourself or use a bookmark; phishing links for Correos arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Correos does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Correos phishing domains

The 10 most recently detected domains impersonating Correos
Domain | First detected | Status at last check | Registrar | 
[correos-entrega.naiwniak.pl](https://phishdestroy.io/domain/correos-entrega.naiwniak.pl/) | 2026-09-26 | Online | home.pl sp. z o.o | 
[bremgartener-goldschmiede.de](https://phishdestroy.io/domain/bremgartener-goldschmiede.de/) | 2026-09-26 | Online | — | 
[correos-entrega.slodkibox.pl](https://phishdestroy.io/domain/correos-entrega.slodkibox.pl/) | 2026-09-26 | Online | home.pl sp. z o.o | 
[e.vg](https://phishdestroy.io/domain/e.vg/) | 2026-08-05 | Online | https://www.101domain.com/ | 
[easybkk.ch](https://phishdestroy.io/domain/easybkk.ch/) | 2026-06-26 | Offline | — | 
[nxk.slj.mybluehost.me](https://phishdestroy.io/domain/nxk.slj.mybluehost.me/) | 2026-04-02 | Offline | Domain.com | 
[caf.bcv.mybluehost.me](https://phishdestroy.io/domain/caf.bcv.mybluehost.me/) | 2026-03-14 | Online | Domain.com | 
[correos.es-accounts.es](https://phishdestroy.io/domain/correos.es-accounts.es/) | 2026-02-20 | Offline | — | 
[correosparcelconnect.anconaresidencial.com](https://phishdestroy.io/domain/correosparcelconnect.anconaresidencial.com/) | 2025-11-30 | Offline | NameCheap | 
[correogoparcelconnecthub.anconaresidencial.com](https://phishdestroy.io/domain/correogoparcelconnecthub.anconaresidencial.com/) | 2025-11-27 | Offline | NameCheap | 

[All 10 Correos reports](https://phishdestroy.io/domain/?brand=Correos)

## Where they are registered and hosted

### Registrars

- [NameCheap](https://phishdestroy.io/registrar/namecheap/)2
- Domain.com2
- home.pl sp. z o.o2
- https://www.101domain.com/1

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)2
- [.me](https://phishdestroy.io/tld/me/)2
- [.pl](https://phishdestroy.io/tld/pl/)2
- [.es](https://phishdestroy.io/tld/es/)1
- [.ch](https://phishdestroy.io/tld/ch/)1
- .vg1
- [.de](https://phishdestroy.io/tld/de/)1

### Hosting networks

- NAMECHEAP-NET, US2
- Oracle Corporation2
- Kraken Network ISP LTD1
- SWIZZONIC-AS swizzonic ltd, CH1
- Cloudflare, Inc.1
- dogado GmbH1
- Joseph Hofmann trading as 'Tornado Datacenter Gm1
- DigitalOcean, LLC1

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Correos; share of all PhishDestroy reports: 0.00%.

Canonical: https://phishdestroy.io/brand/correos/