New Registrations
Correos phishing domains
Newly registered lookalikes - tracked daily
Correos phishing domains
Newly registered lookalikes - tracked daily
Tracked (7d)
28
New (24h)
3
vs avg
—
- Countries
United States 
Germany 
Singapore
Recently registered domains — may be used for phishing. Screenshots show parking pages while domains warm up. Use for Threat Hunting or watchlists.
| Last check (UTC) | First seen (UTC) ▾ | URL | Screenshot | Flags | Details |
|---|---|---|---|---|---|
| 2026-08-12 01:04 | 2026-08-12 01:04 |  |
Details | ||
| 2026-08-12 01:04 | 2026-08-12 01:04 |  |
Details | ||
| 2026-08-11 00:59 | 2026-08-11 00:59 |  |
Details | ||
| 2026-08-10 01:00 | 2026-08-10 01:00 | |
Details | ||
| 2026-08-09 01:17 | 2026-08-09 01:17 |  |
Details | ||
| 2026-08-09 01:16 | 2026-08-09 01:16 |  |
GSB | Details | |
| 2026-08-09 01:16 | 2026-08-09 01:16 |  |
Details | ||
| 2026-08-08 01:39 | 2026-08-08 01:39 | |
Details | ||
| 2026-08-07 01:26 | 2026-08-07 01:26 | |
Details | ||
| 2026-08-07 01:24 | 2026-08-07 01:24 | |
Details | ||
| 2026-08-07 01:24 | 2026-08-07 01:24 |  |
Details | ||
| 2026-08-07 01:24 | 2026-08-07 01:24 |  |
Details | ||
| 2026-08-07 01:24 | 2026-08-07 01:24 | |
Details | ||
| 2026-08-06 01:11 | 2026-08-06 01:11 |  |
Details | ||
| 2026-08-06 01:10 | 2026-08-06 01:10 |  |
Details | ||
| 2026-08-06 01:10 | 2026-08-06 01:10 |  |
Details | ||
| 2026-08-06 01:10 | 2026-08-06 01:10 |  |
Details | ||
| 2026-08-06 01:10 | 2026-08-06 01:10 | |
Details | ||
| 2026-08-06 01:09 | 2026-08-06 01:09 | |
Details | ||
| 2026-08-06 01:09 | 2026-08-06 01:09 | |
Details | ||
| 2026-08-06 01:08 | 2026-08-06 01:08 |  |
Details | ||
| 2026-08-06 01:08 | 2026-08-06 01:08 |  |
GSB | Details | |
| 2026-08-06 01:08 | 2026-08-06 01:08 |  |
Details | ||
| 2026-08-06 00:54 | 2026-08-06 00:54 |  |
Details | ||
| 2026-08-06 00:54 | 2026-08-06 00:54 |  |
Details | ||
| 2026-08-05 01:00 | 2026-08-05 01:00 | |
Details | ||
| 2026-08-05 00:59 | 2026-08-05 00:59 | |
Details | ||
| 2026-08-05 00:59 | 2026-08-05 00:59 | |
Details |
Recently registered domains — may be used for phishing. Screenshots show parking pages while domains warm up. Use for Threat Hunting or watchlists.
| URL | Screenshot | Details |
|---|---|---|
| https://correosl.buzz
|
|
Details |
| https://correosaser.com
|
|
Details |
| https://correos-cr.xyz
|
|
Details |
| https://correosprep.com
|
|
Details |
| https://correosi.top
|
|
Details |
| https://correose.top
GSB |
|
Details |
| https://correo58.net
|
|
Details |
| https://correosfilatelia.mons…
|
|
Details |
| https://correoshublabs.lat
|
|
Details |
| https://correosglobalweb.lat
|
|
Details |
| https://correos612.cyou
|
|
Details |
| https://correos19550.cyou
|
|
Details |
| https://correos159.lat
|
|
Details |
| https://envio-correos.app
|
|
Details |
| https://correoso-gob.icu
|
|
Details |
| https://correoslogis69795.sbs
|
|
Details |
| https://correoslogis391.sbs
|
|
Details |
| https://correosgobfhh.top
|
|
Details |
| https://correosgobfhf.top
|
|
Details |
| https://correosgobfhd.top
|
|
Details |
| https://correosbolivia.bond
|
|
Details |
| https://correosbo.cfd
GSB |
|
Details |
| https://correos-god.icu
|
|
Details |
| https://ams-correosdemexico.c…
|
|
Details |
| https://ams-correosdemexico-m…
|
|
Details |
| https://correosg.cfd
|
|
Details |
| https://correos.hair
|
|
Details |
| https://correos-gob.icu
|
|
Details |
AIHow to verify a real Correos URL
- Legitimate Correos URLs always end in
correos.es(e.g.www.correos.es,account.correos.es). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like.xyz/.top/.vip— is not Correos. - The domains listed above were registered within the last 7 days. New-domain age is itself a signal — Correos has owned
correos.esfor years; brand-new look-alikes are almost never legitimate. - If you got the link from email, SMS, or social media, do not click it. Open
correos.esfrom your browser bookmark or type the domain manually. - Real Correos pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.