correios[.]controleaduana[.]com[.]br

The domain correios.controleaduana.com.br was registered on June 12, 2026 through GoDaddy and is currently resolving to the IP address 104.21.50.151. DNS resolution is served by two Cloudflare name servers, gigi.ns.cloudflare.com and josh.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare's CDN infrastructure. VirusTotal reports that 4 out of 91 security vendors have flagged the domain, providing limited but notable detection coverage. The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy service, which suggests that defensive feeds have recognized it as malicious.

No additional public indicators such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts are available in the current intelligence set. Consequently, the precise content hosted on the site remains unverified, and the exact phishing campaign tactics cannot be confirmed beyond the generic phishing classification. Defenders should continue to block the domain at network perimeter controls and update endpoint protection signatures to reflect the four vendor detections.

Monitoring of the associated IP address 104.21.50.151 for new activity is advised, as Cloudflare may host multiple unrelated sites on the same address. Organizations that rely on the brand implied by the subdomain "correios" should educate users about unsolicited communications that reference this domain, reinforce credential‑verification procedures, and consider employing URL filtering solutions that reference the known blocklist entry. Ongoing intelligence collection should focus on retrieving the site’s HTTP response, TLS details, and any observed phishing payloads to refine detection rules and improve threat attribution.