uspsexpress[.]com

Analysis of the domain uspsexpress.com indicates it was actively involved in a brand impersonation campaign targeting USPS, classified as a crypto scam. The domain was registered on October 28, 2025, through NameSilo, LLC, and resolved to the IP address 49.12.128.176, hosted on AS24940 (Hetzner Online GmbH) in Germany. At the time of assessment, the domain was offline, though it previously displayed the page title 'Track Your Package - USPSExpress,' suggesting an attempt to mimic a legitimate USPS tracking portal. Security vendor detections on VirusTotal flagged the domain as malicious, with 15 out of 93 engines identifying it as a threat.

The domain also appeared on one security blocklist (PhishDestroy) and was referenced in 13 threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious activity. Gridinsoft assigned a trust score of 0/100, reinforcing the elevated risk classification. The SSL certificate (R12) does not provide meaningful trust validation, as such certificates are commonly used in phishing infrastructure. Defenders should treat this domain as confirmed malicious infrastructure.

While the site is currently offline, historical resolution data (49.12.128.176) and registrar details (NameSilo, LLC) may be useful for retrospective hunting or blocking rules. The combination of brand impersonation, crypto scam classification, and detection by multiple security vendors justifies immediate inclusion in deny lists. No evidence suggests the domain was used for legitimate purposes, and its creation date aligns with typical phishing campaign timelines. Further monitoring of related infrastructure under the same registrar or hosting provider is recommended.