usps[.]xupqwru[.]one

This domain, usps.xupqwru.one, is identified as a delivery scam targeting users through fraudulent parcel tracking notifications. Analysis indicates the domain impersonates the United States Postal Service (USPS) branding to deceive recipients into interacting with malicious links or entering sensitive credentials. No specific drainer kit has been conclusively linked to this campaign, though the infrastructure aligns with common credential-harvesting tactics observed in similar phishing operations. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on May 22, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 43.157.158.108, geolocated in Brazil under the provider Acevillepteltd SG. The domain appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, including detection as a phishing threat. The SSL certificate, issued by Let's Encrypt (serial number E8), provides minimal encryption but does not validate legitimacy. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than absence of risk. As of the latest assessment, usps.xupqwru.one has been taken offline, likely in response to security vendor interventions or hosting provider actions. However, the elevated risk level persists due to the domain's recent registration, association with known malicious infrastructure, and the potential for rapid redeployment under a new hostname or IP. Users are advised to treat any prior communications linked to this domain as fraudulent and to verify parcel tracking information exclusively through official USPS channels. Organizations should monitor for related indicators, including the IP address 43.157.158.108 and domains registered via Gname.com Pte. Ltd., to preemptively block emerging variants.