correogoparcelconnecthub[.]anconaresidencial[.]com

The domain correogoparcelconnecthub.anconaresidencial.com is currently active and exhibits multiple indicators consistent with a brand‑impersonation campaign targeting Correos. The site returns HTTP 200 and presents the page title “Human Verification | Correos”, directly referencing the legitimate postal service. The SSL certificate is issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, confirming that TLS termination is functional but offering no validation of the underlying content. DNS resolution points to IP 66.29.146.14, an address owned by AS22612 (Namecheap, Inc.) and geolocated to the United States; the same IP is associated with the registrar NameCheap, Inc., which also provided the domain’s registration.

The domain was created on 30 September 2021, indicating a relatively long‑standing presence. Reputation services flag the domain as highly suspicious: Scamadviser assigns a trust score of 1 / 100, Gridinsoft rates it 0 / 100, and it appears on one security blocklist. Google Safe Browsing classifies the site as social‑engineering, and PhishDestroy has already blocked it. VirusTotal analysis shows that 14 of 95 security vendors label the domain as malicious, reinforcing the suspicion.

While the observable infrastructure (nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com) is typical for low‑cost hosting, no additional payload or redirect behavior has been publicly disclosed, leaving the exact phishing kit unknown. Defenders should block the domain at network perimeter, add the IP address 66.29.146.14 to deny‑list policies, and monitor for any traffic matching the “Human Verification | Correos” title. Continuous re‑scanning of the domain on multi‑vendor platforms is advised, as the current detection count may evolve. Users should be warned that any request for verification or credential entry on this domain is likely fraudulent and should be reported to the legitimate Correos security team.