correios[.]controleaduaneiro[.]com[.]br

Analysis of the domain correios.controleaduaneiro.com.br indicates it is an active phishing site impersonating Correios, Brazil's national postal service. The domain was registered on June 11, 2026, through GoDaddy, a common registrar for both legitimate and malicious domains. Infrastructure analysis reveals it resolves to the IP address 104.21.11.30, which is associated with Cloudflare's network, often utilized to obscure hosting origins and evade takedowns. The nameservers, josh.ns.cloudflare.com and gigi.ns.cloudflare.com, further confirm Cloudflare's involvement in its DNS resolution. As of July 29, 2026, the domain appears on one security blocklist, specifically PhishDestroy, suggesting preliminary detection by at least one vendor.

VirusTotal reports that 6 out of 91 security vendors flag this domain, indicating moderate but not universal detection. The absence of broader blocklist inclusion or additional vendor alerts may reflect limited visibility or recent activation of the phishing campaign. The domain's subdomain structure, 'correios,' directly references the Correios brand, aligning with the phishing classification. However, the exact content of the site has not been analyzed, and no specific phishing kit or payload details are available. The use of Cloudflare complicates further infrastructure analysis, as it masks the true hosting provider and geographic origin of the server.

Defenders should treat this domain as an elevated-risk phishing resource. Recommended actions include blocking the domain and its resolving IP at perimeter security controls, monitoring for internal access attempts, and alerting users to the threat. Given the domain's recent registration and moderate detection rate, continued monitoring for additional vendor flags or blocklist inclusion is advised. Organizations should also review logs for connections to 104.21.11.30, particularly from systems accessing postal or logistics-related services.