dtr3-489991573399[.]southamerica-east1[.]run[.]app

The domain dtr3-489991573399.southamerica-east1.run.app has been identified as a confirmed phishing site, with a high risk level currently marked as active. Analysis indicates that this domain was created on June 13, 2026, and has already attracted attention from security vendors, with 3 out of 95 flagging it on VirusTotal. Furthermore, the domain resolves to the IP address 34.143.79.2, a key piece of evidence for its active status. The domain is blocked by PhishDestroy, reinforcing its classification as a phishing threat. Additionally, it appears on one known security blocklist, which raises further concerns regarding its legitimacy and intent.

The SSL certificate is issued by Google Trust Services, which is often associated with legitimate websites. However, the presence of advanced technologies such as Twitter Ads, Taboola, Microsoft Advertising, and Google Tag Manager may indicate attempts to lend credibility to the phishing endeavor or to monetize fraudulent activities. The Gridinsoft trust score of 0 out of 100 starkly contrasts with the technological toolkit in use, suggesting a calculated yet ultimately untrustworthy operation. The title of the page, "Minhas Importações Correios: como acessar e rastrear pedidos," translates to a request for accessing and tracking orders, a common tactic used in phishing campaigns to lure victims into providing personal information.

Defenders should be vigilant and consider implementing blocking measures against this domain, particularly for users who may be misled into thinking it is a legitimate service. Continuous monitoring for any changes in the domain's status or related infrastructure is also advised, as phishing operations can evolve rapidly. Given its recent creation and current flagging by multiple vendors, it is crucial for organizations to educate their users on recognizing potential phishing attempts and to report any suspicious activities associated with this domain.