claim[.]usps[.]zda[.]com

The domain claim.usps.zda.com was observed to be offline at the time of analysis on 22 July 2026. Registration metadata indicate the domain was created on 1 July 2001 and is registered through eName Technology Co.,Ltd. The authoritative name servers are ns3.dns.com and ns4.dns.com, and DNS resolution points to the IPv4 address 47.115.133.146. Geolocation of the address places the host in China, specifically under AS37963 belonging to Hangzhou Alibaba Advertising Co.,Ltd. No TLS certificate is presented for the host, meaning HTTPS connections are not available. The site title returned by the HTTP response is “USPS_simu”, and the brand target field lists USPS, confirming that the domain is intended to impersonate the United States Postal Service brand. Threat intelligence shows the domain is listed on a single security blocklist, currently PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, indicating a highly malicious reputation.

VirusTotal scanning recorded a single positive detection out of 95 contributing vendors, reinforcing the suspicion of malicious intent. Apart from the blocklist entry, no additional public intelligence feeds have reported activity for this host. Given the lack of an SSL certificate, the offline status, and the minimal detection footprint, the current operational capability of the domain is unclear; it may have been taken down by mitigation efforts or could be reactivated later. Defenders should continue to block the domain at perimeter defenses, update DNS blacklists with the observed IP address 47.115.133.146, and monitor for any resurgence of the host under the same or similar sub‑domains.

Network monitoring should include alerts for DNS queries to ns3.dns.com or ns4.dns.com that resolve to the listed IP, and any HTTP requests that return the page title “USPS_simu”.