crs1-315486695103[.]southamerica-east1[.]run[.]app

This domain, crs1-315486695103.southamerica-east1.run.app, is flagged as a credential theft operation targeting users of Correios, Brazil’s national postal service. Analysis of the page title, "Minhas Importações Correios: como acessar e rastrear pedidos," confirms the domain impersonates the legitimate Correios login portal, likely harvesting user credentials for account takeover or fraudulent transactions. No crypto drainer or payment skimmer components were detected, focusing the threat on credential acquisition rather than direct financial exfiltration. Infrastructure analysis reveals the domain resolves to IP address 34.143.75.2, hosted on Google Cloud Run infrastructure. The domain is registered through Google’s cloud services, with an SSL certificate issued by Google Trust Services. VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, though the domain’s transient nature on cloud hosting may contribute to delayed detection. The domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains active, and similar campaigns may re-emerge using comparable cloud-hosted subdomains. Response actions should include monitoring for related subdomains under southamerica-east1.run.app and alerting users who may have interacted with the fraudulent portal. Remaining risk includes potential credential reuse across other platforms and secondary phishing attempts targeting affected users. Organizations are advised to block the IP 34.143.75.2 and implement email filtering rules to detect similar impersonation attempts.