customs-id[.]irish

This domain, customs-id.irish, is identified as a phishing site impersonating An Post, the national postal service of Ireland, to deceive users into submitting customs fee payments or login credentials. The site presents itself as an official customs clearance portal, likely targeting individuals expecting international deliveries. Analysis indicates the threat involves a fake login or payment form designed to harvest personal and financial information, potentially leading to unauthorized transactions or identity theft.

Technical evidence supporting this assessment includes the domain's registration details and detection metrics. The domain was registered on April 30, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with low-reputation domains. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, suggesting the threat is either new or employs evasion techniques. The domain appears on three security blocklists and resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure. The page title, anpost-customs.digital, further confirms the impersonation of An Post's branding.

Users who have visited customs-id.irish or interacted with its content should take immediate action to mitigate potential risks. If any personal, financial, or login information was entered, affected individuals should change passwords for all critical accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized activity. Devices used to access the site should be scanned for malware using updated security tools. Additionally, users are advised to verify the legitimacy of any unexpected customs fee requests by contacting the official postal service through verified channels.