auspost[.]customerservicew[.]com

Analysis as of July 29, 2026 indicates that the subdomain auspost.customerservicew.com is actively used in a generic phishing campaign. The domain was registered on June 10, 2026 through Dominet (HK) Limited, a registrar known to host malicious infrastructure in the past. DNS resolution points to the single IPv4 address 47.79.39.190, which is currently listed on one public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole service. VirusTotal scans show that 16 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, providing independent corroboration of its hostile intent.

The elevated risk rating and active status further suggest ongoing exploitation. No additional intelligence such as page title, SSL certificate details, or observed HTTP response codes has been published, leaving the exact content of the site unverified. Consequently, defenders cannot confirm the specific lure or credential‑harvesting technique employed beyond the generic phishing classification. Given the observable indicators, security teams should add auspost.customerservicew.com to their deny lists, enforce DNS sinkholing for the 47.79.39.190 address, and monitor outbound connections from internal hosts to that IP.

Network intrusion detection signatures that flag HTTP requests containing the domain name or its sub‑domains should be deployed. Email filtering rules should be updated to block messages that reference the domain or its registrar, Dominet (HK) Limited. Continuous re‑evaluation is advised, as further analysis may reveal additional command‑and‑control endpoints or payloads associated with this infrastructure.