# PhishDestroy domain threat record: uspsecuredlogs.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/uspsecuredlogs.com/
Machine-readable companion: https://phishdestroy.io/domain/uspsecuredlogs.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-06 21:09:44 UTC
- Last availability or vendor check: 2026-10-22 10:34:04 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: USPS

## Stored infrastructure

- Observed IP address: 207.210.229.232
- Registrar in stored WHOIS data: NEUBOX Internet S.A. de C.V.
- Last stored HTTP status: 200
- Registration date (registry RDAP, uspsecuredlogs.com): 2026-08-31 23:30:59 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a10bb4-5d37-7007-b9a8-9f86db4e0630/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/uspsecuredlogs.com
- Certificate Transparency search: https://crt.sh/?q=%25.uspsecuredlogs.com
- Web Archive lookup: https://web.archive.org/web/*/https://uspsecuredlogs.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
uspsecuredlogs.com is a phishing site that impersonates USPS, the United States Postal Service. It targets people who expect a delivery or receive a message about one. PhishDestroy first flagged it on 2026-10-06. When checked on 2026-10-19 it was still online and serving live content. The page title reads only "Home de uspsecuredlogs.com", a generic placeholder with no postal branding, while our classification is based on its USPS impersonation.

How the scam works
USPS lures usually start with a text or email saying a package is on hold because of an incomplete address or an unpaid redelivery or customs fee. The link leads to a page dressed up as USPS. It asks for your name, home address, phone number and email, then card details to settle a small charge. That fee is the bait. The real prize is the full card data and identity details, which are used for fraudulent purchases or resold.

Evidence
On 2026-10-07, 13 of 92 VirusTotal engines flagged the domain. They include Google Safe Browsing, BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, CRDF and alphaMountain.ai. Google Safe Browsing classifies it as SOCIAL_ENGINEERING, which is its category for deceptive phishing pages and drives browser warnings. Spamhaus lists it in its domain blocklist as DBL_PHISH. Phishunt blocks it alongside PhishDestroy, and three AlienVault OTX threat pulses reference it, so several independent sources reached the same verdict.

Infrastructure
The domain was registered on 2026-08-31 through NEUBOX Internet S.A. de C.V., about five weeks before PhishDestroy detected it. Throwaway phishing domains are often registered shortly before a campaign starts. It is hosted in the United States on the TierPoint, LLC network (AS17378). It uses a free Let's Encrypt certificate, so the padlock in the address bar only means the connection is encrypted. It says nothing about who runs the site.

What to do
If you entered card details, call your bank now. Ask them to cancel the card, block pending charges and dispute any you don't recognise. If you gave your address, phone number or email, expect follow-up scam calls and texts, and don't trust messages that quote those details back to you. If you reused a password on the page, change it everywhere you use it and turn on two-factor authentication. USPS does not text links asking for redelivery fees, so delete such messages and forward them to USPS's spam reporting channel. Defenders should block the domain at DNS and email gateways and search logs for any users who reached it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a10bb4-5d37-7007-b9a8-9f86db4e0630/
VirusTotal report: https://www.virustotal.com/gui/domain/uspsecuredlogs.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=uspsecuredlogs.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:30:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a10bb4-5d37-7007-b9a8-9f86db4e0630.png
  Captured: 2026-10-06 21:09:44 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a10bb4-5d37-7007-b9a8-9f86db4e0630.png
  Captured: 2026-10-07 03:30:34 UTC
  Source report: https://urlscan.io/result/01a10bb4-5d37-7007-b9a8-9f86db4e0630/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cb087d63-bb4a-40c4-99d1-980f97e3fc49.png
  Captured: 2026-10-06 21:21:53 UTC
  Source report: https://radar.cloudflare.com/scan/cb087d63-bb4a-40c4-99d1-980f97e3fc49
  SHA-256: fc26e288589b5b39794b9cf1d49e4b5d879a25921b2d2deb5d60f97bf5f2216c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:31:01Z",
        "uuid": "01a10bb4-5d37-7007-b9a8-9f86db4e0630",
        "scanned_at": "2026-10-05T10:55:40Z",
        "final_url": "https://uspsecuredlogs.com/",
        "status": 200,
        "ip": "207.210.229.232",
        "ptr": "svgt445.serverneubox.com.mx",
        "domains": [
            "neubox.com",
            "ajax.googleapis.com"
        ],
        "ips": [
            "2a00:1450:4001:c15::5f",
            "172.66.150.44",
            "207.210.229.232"
        ],
        "asns": [
            "15169",
            "13335",
            "17378"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "link_domains": [
            "neubox.com",
            "clientes.neubox.com",
            "ayuda.neubox.com",
            "www.facebook.com",
            "twitter.com",
            "www.youtube.com",
            "instagram.com",
            "blog.neubox.com",
            "www.linkedin.com"
        ],
        "social": [
            "https://www.facebook.com/NEUBOX",
            "https://twitter.com/NEUBOX",
            "https://www.youtube.com/c/NEUBOXInternet",
            "http://instagram.com/neubox"
        ],
        "doc_hash": "f148c0b84b5b1504c27b83853a547a27850c0352daba8d5ecb0d522f21d2d076",
        "globals": [
            "$",
            "jQuery"
        ],
        "tls": {
            "san": [
                "*.italianeservizipostali.finanziari-assicurativi.uspsecuredlogs.com",
                "autoconfig.uspsecuredlogs.com",
                "autodiscover.uspsecuredlogs.com",
                "cpanel.uspsecuredlogs.com",
                "cpcalendars.uspsecuredlogs.com",
                "cpcontacts.uspsecuredlogs.com",
                "italianeservizipostali.finanziari-assicurativi.uspsecuredlogs.com",
                "mail.uspsecuredlogs.com",
                "uspsecuredlogs.com",
                "webdisk.uspsecuredlogs.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "autodiscover.uspsecuredlogs.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-30T02:07:46Z",
            "valid_from": "2026-09-01T02:07:47Z"
        },
        "domain_age_days": 34,
        "apex_age_days": 34,
        "tls_age_days": 34,
        "tls_valid_days": 89,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.34",
            "strict-transport-security": "max-age=31536000",
            "content-security-policy": "upgrade-insecure-requests;",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:39:59Z",
        "uuid": "cb087d63-bb4a-40c4-99d1-980f97e3fc49",
        "scanned_at": "2026-10-06T21:21:53Z",
        "final_url": "https://uspsecuredlogs.com/",
        "status": 200,
        "history": [
            {
                "url": "https://uspsecuredlogs.com/",
                "status": 200
            }
        ],
        "dom_hash": "73b9b69aa4fba0b159087e2a617c362e555e79941b342a9639f9c3b958d02142",
        "doc_hash": "f148c0b84b5b1504c27b83853a547a27850c0352daba8d5ecb0d522f21d2d076",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Parked & For Sale Domains",
            "Security Risks",
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "uspsecuredlogs.com",
                "type": "A",
                "value": "207.210.229.232"
            }
        ],
        "dnssec_valid": false,
        "ip": "207.210.229.232",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Neubox Internet S.A. de C.V.",
            "created": "2026-08-31T23:30:59Z",
            "updated": "2026-08-31T23:30:59Z",
            "expires": "2027-08-31T23:30:59Z",
            "nameservers": [
                "ns143.neubox.net",
                "ns144.neubox.net",
                "ns245.neubox.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T11:50:48Z",
        "analysis_at": "2026-10-09T12:32:02Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "domain_parking",
            "Sophos": "spyware and malware",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "NEUBOX Internet S.A. de C.V.",
        "created": "2026-08-31T23:30:59Z",
        "expires": "2027-08-31T23:30:59Z",
        "updated": "2026-08-31T23:31:00Z",
        "first_seen": "2026-09-01T00:09:19Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "A",
                "value": "207.210.229.232"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns245.neubox.net"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:207.210.229.232 include:relay.mailchannels.net include:smtp.relay.serverneubox.com.mx ~all"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.svgt445.serverneubox.com.mx",
                "value": "ns144.neubox.net"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "mail.uspsecuredlogs.com",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns143.neubox.net"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns144.neubox.net"
            }
        ],
        "dns_at": "2026-10-09T12:33:12Z",
        "jarm": "29d29d15d29d29d00042d42d00000072e74222ce193a6f991becaa3da6c94d",
        "cert": {
            "san": [
                "*.italianeservizipostali.finanziari-assicurativi.uspsecuredlogs.com",
                "autoconfig.uspsecuredlogs.com",
                "autodiscover.uspsecuredlogs.com",
                "cpanel.uspsecuredlogs.com",
                "cpcalendars.uspsecuredlogs.com",
                "cpcontacts.uspsecuredlogs.com",
                "italianeservizipostali.finanziari-assicurativi.uspsecuredlogs.com",
                "mail.uspsecuredlogs.com",
                "uspsecuredlogs.com",
                "webdisk.uspsecuredlogs.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6962d316eefc55b40138b090caef8dca356",
            "sha256": "70dcf3a5b6cd1da004f6350460242bec094257613f5b959e25416ed41a621c12",
            "subject": "autodiscover.uspsecuredlogs.com",
            "valid_to": "2026-11-30T02:07:46Z",
            "valid_from": "2026-09-01T02:07:47Z"
        },
        "whois": {
            "registrar": "NEUBOX Internet S.A. de C.V.",
            "registrar_iana_id": "1483",
            "registrar_url": "http://neubox.com/",
            "created": "2026-08-31T23:30:59Z",
            "updated": "2026-08-31T23:30:59Z",
            "expires": "2027-08-31T23:30:59Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns143.neubox.net",
                "ns144.neubox.net",
                "ns245.neubox.net"
            ],
            "dnssec": "Unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-31T23:31:00Z",
                "registration": "2026-08-31T23:30:59Z",
                "registrar expiration": "2027-08-31T23:30:59Z",
                "last update of RDAP database": "2026-10-05T07:11:39Z"
            }
        }
    }
}
```