New Registrations

Correos phishing domains

Newly registered lookalikes - tracked daily


Correos phishing domains

Newly registered lookalikes - tracked daily


Tracked (7d)
18
New (24h)
5
vs avg
About
AISpanish postal lure - same parcel-delivery 'fee required' pattern as DHL / FedEx, localised to Spain. Almost always SMS-launched.
TLDs
.lol (5) · .cyou (2) · .top (2)
Countries
United StatesUnited States (13) · GermanyGermany (3) · SingaporeSingapore (1)

Recently registered domains — may be used for phishing. Screenshots show parking pages while domains warm up. Use for Threat Hunting or watchlists.

Last check (UTC) First seen (UTC) URL Screenshot Flags Details
2026-06-12 01:10 2026-06-12 01:10
https://correos855.click
Screenshot of correos855.click Details
2026-06-12 01:09 2026-06-12 01:09
https://correos76139.cyou
Screenshot of correos76139.cyou Details
2026-06-12 01:09 2026-06-12 01:09
https://correos48540.sbs
Screenshot of correos48540.sbs Details
2026-06-12 01:09 2026-06-12 01:09
https://correos291.cyou
Screenshot of correos291.cyou Details
2026-06-11 01:21 2026-06-11 01:21
https://correosr.top
Screenshot of correosr.top Details
2026-06-08 00:58 2026-06-08 00:58
https://correosscl.top
Screenshot of correosscl.top Details
2026-06-07 01:11 2026-06-07 01:11
https://correosuyuguay.forum
Screenshot of correosuyuguay.forum Details
2026-06-07 01:10 2026-06-07 01:10
https://correoss.store
Screenshot of correoss.store Details
2026-06-07 01:10 2026-06-07 01:10
https://correoss.org
Screenshot of correoss.org Details
2026-06-07 01:10 2026-06-07 01:10
https://correoss.info
Screenshot of correoss.info Details
2026-06-07 01:09 2026-06-07 01:09
https://correosconectamosalpais.com
Screenshot of correosconectamosalpais.com Details
2026-06-06 01:19 2026-06-06 01:19
https://correosunivalle.com
Screenshot of correosunivalle.com Details
2026-06-06 01:19 2026-06-06 01:19
https://correosmart.online
Screenshot of correosmart.online Details
2026-06-06 01:19 2026-06-06 01:19
https://correoschilen.lol
Screenshot of correoschilen.lol Details
2026-06-06 01:19 2026-06-06 01:19
https://correoschilem.lol
Screenshot of correoschilem.lol Details
2026-06-06 01:19 2026-06-06 01:19
https://correoschilek.lol
Screenshot of correoschilek.lol Details
2026-06-06 01:19 2026-06-06 01:19
https://correoschileb.lol
Screenshot of correoschileb.lol Details
2026-06-06 01:19 2026-06-06 01:19
https://correoschile.lol
Screenshot of correoschile.lol Details

Recently registered domains — may be used for phishing. Screenshots show parking pages while domains warm up. Use for Threat Hunting or watchlists.

URL Screenshot Details
https://correos855.click
Screenshot of correos855.click Details
https://correos76139.cyou
Screenshot of correos76139.cyou Details
https://correos48540.sbs
Screenshot of correos48540.sbs Details
https://correos291.cyou
Screenshot of correos291.cyou Details
https://correosr.top
Screenshot of correosr.top Details
https://correosscl.top
Screenshot of correosscl.top Details
https://correosuyuguay.forum
Screenshot of correosuyuguay.forum Details
https://correoss.store
Screenshot of correoss.store Details
https://correoss.org
Screenshot of correoss.org Details
https://correoss.info
Screenshot of correoss.info Details
https://correosconectamosalpa…
Screenshot of correosconectamosalpais.com Details
https://correosunivalle.com
Screenshot of correosunivalle.com Details
https://correosmart.online
Screenshot of correosmart.online Details
https://correoschilen.lol
Screenshot of correoschilen.lol Details
https://correoschilem.lol
Screenshot of correoschilem.lol Details
https://correoschilek.lol
Screenshot of correoschilek.lol Details
https://correoschileb.lol
Screenshot of correoschileb.lol Details
https://correoschile.lol
Screenshot of correoschile.lol Details

AIHow to verify a real Correos URL

  • Legitimate Correos URLs always end in correos.es (e.g. www.correos.es, account.correos.es). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not Correos.
  • The domains listed above were registered within the last 7 days. New-domain age is itself a signal — Correos has owned correos.es for years; brand-new look-alikes are almost never legitimate.
  • If you got the link from email, SMS, or social media, do not click it. Open correos.es from your browser bookmark or type the domain manually.
  • Real Correos pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.