correiosimportacoes[.]portaldoimportador[.]com

The domain correiosimportacoes.portaldoimportador.com was first observed on June 12, 2026, when it was registered through GoDaddy.com, LLC. It resolves to the IPv4 address 172.67.135.107, an address associated with a public hosting infrastructure that is commonly used for fast‑flux or proxy services. The domain has been listed on a security blocklist and is actively blocked by the PhishDestroy mitigation platform. VirusTotal scans indicate that eleven of ninety‑one scanning engines have flagged the domain as malicious, suggesting that a subset of security products have identified it as part of a phishing campaign.

No additional intelligence such as SSL certificate details, HTTP response codes, Safe Browsing status, or page‑title metadata is currently available, and the content of the site has not been publicly analysed. The combination of recent registration, hosting on a shared address, and detection by multiple security vendors aligns with typical infrastructure used for credential‑harvesting operations targeting users of the "PortaldoImportador" portal.

Defenders should consider adding the domain to outbound and inbound filtering rules, monitoring traffic to the associated IP for anomalous patterns, and employing sink‑hole or DNS‑sink techniques to disrupt potential command‑and‑control channels. Continuous re‑assessment is advised, as further forensic examination of the hosting environment and any retrieved web content could reveal additional indicators of compromise or victim targeting vectors.