correios[.]minhasimportacoes[.]com

On July 29, 2026 the domain correios.minhasimportacoes.com was identified as an active phishing infrastructure. The domain was registered through GoDaddy.com, LLC on June 12, 2026 and is delegated to the Cloudflare authoritative nameservers odin.ns.cloudflare.com and wally.ns.cloudflare.com. DNS resolution points to the address 104.21.4.22, which belongs to Cloudflare’s edge network. VirusTotal scans show that five of ninety‑one security vendors flagged the domain as malicious, indicating a modest but consistent detection rate across multiple engines.

The domain appears on one public blocklist and is currently listed by the PhishDestroy blocking service, confirming that at least one mitigation platform has taken action against it. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is available at this time. Consequently, the precise phishing lure, target brand, and credential‑collection methodology remain unknown.

Analysts should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the associated IP address, and consider adding the IP to threat‑intel feeds. Continuous re‑evaluation is advised, as further crawling or victim reports may reveal the underlying credential‑harvesting page and allow attribution of the campaign’s payload. Defenders are recommended to update web‑filtering rules to include the domain and its resolving IP, and to review email gateway logs for messages referencing “correios” or “importações” that could be linked to this indicator.