captcha[.]usmql[.]net

This domain, captcha.usmql.net, is actively impersonating UPS as part of a high-risk brand impersonation campaign. Registered on February 12, 2026, through Cloudflare, Inc., the domain resolves to the IP address 172.67.178.115, which is hosted on Cloudflare’s network (AS13335) in the United States. The page title, 'USMQL AntiBot,' suggests an attempt to mimic legitimate bot verification systems, a common tactic in phishing operations to lend credibility to fraudulent interactions. Analysis indicates the domain is currently operational, returning an HTTP 200 status, and has been flagged by at least one security blocklist, including PhishDestroy. Infrastructure analysis reveals the use of Cloudflare’s nameservers (bradley.ns.cloudflare.com and dolly.ns.cloudflare.com), a frequent choice among threat actors to obscure hosting origins and evade takedown efforts. The domain is also leveraging Cloudflare Browser Insights and HTTP/3, technologies that may complicate detection and mitigation due to their association with legitimate services. While only one out of ninety-five security vendors on VirusTotal has flagged this domain as malicious, this low detection rate does not necessarily indicate safety, as phishing domains often evade initial scans before gaining broader attention. The scam type has been classified as impersonation, specifically targeting UPS, a common vector for parcel delivery fraud. The Gridinsoft trust score of 0/100 further corroborates the domain’s malicious intent. Defenders should treat this domain as an active threat, particularly in environments where UPS communications are critical. Network-level blocking of 172.67.178.115 and monitoring for related domains using similar naming conventions (e.g., 'captcha' or 'usmql') is recommended. Given the domain’s reliance on Cloudflare, rapid takedown may be challenging, necessitating proactive email filtering and user awareness to prevent credential theft or financial fraud.