auspost-app[.]com

This domain, auspost-app.com, is a confirmed phishing site designed to impersonate the legitimate Australia Post (AusPost) application download portal. The site presents a fraudulent page titled 'AusPost App — Download Now,' targeting users seeking official postal service software. Analysis indicates the domain is engineered to harvest login credentials, distribute malicious payloads, or facilitate financial fraud through social engineering tactics. The infrastructure is optimized for rapid deployment and evasion, typical of large-scale phishing campaigns targeting regional postal services. Evidence supporting the malicious classification includes multiple technical indicators. The domain was registered on April 27, 2026, through OwnRegistrar, Inc., a registrar frequently associated with high-risk domains. It resolves to IP address 91.202.233.133, hosted in Turkmenistan under Prospero OOO, a provider linked to bulletproof hosting services. The domain appears on three security blocklists, and Google Safe Browsing explicitly flags it as phishing. VirusTotal analysis reveals that 20 out of 95 security vendors detect the domain as malicious, with detections including credential phishing, malware distribution, and fraudulent application spoofing. The SSL certificate, issued by Let's Encrypt (R13), is valid but does not mitigate the inherent risk, as phishing sites commonly use legitimate certificates to appear trustworthy. Users who visited auspost-app.com or interacted with its content should take immediate remedial actions. Disconnect affected devices from networks to prevent lateral movement or data exfiltration. Conduct a full system scan using updated security tools to detect and remove any downloaded payloads or persistent threats. Reset credentials for any accounts accessed from the compromised device, particularly those related to financial services, email, or postal accounts. Monitor accounts for unauthorized transactions or suspicious activity. If personal or financial data was entered on the site, consider reporting the incident to relevant authorities and credit monitoring services. Infrastructure analysis reveals the domain is now offline, but users should remain vigilant for similar phishing attempts using lookalike domains or alternative delivery methods.