correos[.]es-accounts[.]es

This report details a threat site targeting users of the Spanish postal service. The site, with the title "Correos | Recibir Paquete," impersonates the Correos brand to execute a shipping scam. This scam poses a threat of social engineering, as it likely attempts to trick users into providing personal information or payment under the guise of receiving a package.

Technical evidence shows the site was flagged by 22 of 95 VirusTotal vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, Cluster25, and CRDF. Google Safe Browsing flagged it for SOCIAL_ENGINEERING, and it appears on 1 blocklist. The domain correos.es-accounts.es was created on 2026-02-21 and resolves to IP address 80.71.224.112 in the Netherlands, hosted by AS209274 Kraken Network ISP LTD. The site had no SSL certificate.

The site is currently offline, reducing the immediate risk. However, the high detection rate and social engineering flag indicate a significant threat to users who may have encountered it while active. The risk level is considered high due to the impersonation of a trusted brand and the potential for credential theft.