correios[.]pagamentoimportacoes[.]com[.]br

On 29 July 2026, the domain correios.pagamentoimportacoes.com.br was observed as an active phishing infrastructure. The domain was registered through GoDaddy on 9 June 2026 and resolves to the IPv4 address 172.67.204.236, which is hosted on a cloud service provider. VirusTotal has recorded five detections out of ninety‑one submitted security‑vendor scans, indicating that a minority of AV engines flag the domain as malicious.

The domain also appears on a single public blocklist and is listed as blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. The available intelligence does not include SSL certificate details, HTTP response codes, page title, or explicit brand targeting, so the exact content served by the site remains unverified. The limited detection count combined with blocklist presence suggests a low‑profile campaign that relies on the recent registration to evade long‑term reputation systems.

Defenders should add the domain and its associated IP address to outbound filtering rules, monitor DNS queries for look‑ups, and ensure that any email communications referencing “correios” or payment import services are scrutinized. Continuous re‑scanning on VirusTotal and periodic checks against emerging blocklists are recommended to capture any evolution in the threat profile.