correiosintimacao[.]com[.]br

This domain, correiosintimacao.com.br, is flagged as a high-risk generic phishing site designed to impersonate Correios, Brazil’s national postal service. Analysis indicates the infrastructure is actively used to distribute fraudulent notifications, likely aiming to harvest personal and financial data from unsuspecting users. No specific drainer kit signatures have been confirmed, but the domain’s design and naming convention strongly suggest credential theft or malware distribution as primary objectives. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 157.151.2.38 and was registered on June 29, 2026, an anomalous future date likely indicative of falsified records. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing (GSB) has not yet listed it. The domain uses a Let’s Encrypt SSL certificate, a common tactic to feign legitimacy, and is hosted on an Ubuntu server running Nginx with HSTS enabled. No registrar details are publicly accessible, and the domain currently appears on at least three blocklists. As of the latest assessment, correiosintimacao.com.br remains active and unresolved by hosting providers or domain registrars. Users are advised to avoid interaction, as the site continues to serve phishing content. Immediate response actions should include browser-based blocking, network-level filtering of the IP, and reporting to relevant CERT teams. Despite partial vendor detection, the remaining risk is classified as high due to the domain’s operational status, deceptive branding, and lack of takedown measures. Organizations should monitor for related indicators, including the IP and SSL certificate, to prevent further exposure.