stampsoffers[.]com

This domain, stampsoffers.com, is flagged as an active phishing site targeting users with a fraudulent Forever Stamps storefront. Registered on February 27, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to 104.21.77.160 (AS13335, Cloudflare, Inc.) with nameservers gabriella.ns.cloudflare.com and kaiser.ns.cloudflare.com. The site presents itself as an 'Authorized Factory Outlet Online' under the page title 'Forever Stamps Store – Authorized Factory Outlet Online,' though no evidence confirms legitimate affiliation with the United States Postal Service (USPS) or any authorized stamp distributor. Analysis indicates a 301 HTTP redirect, suggesting the domain may be part of a larger redirection chain, though the final destination remains unconfirmed. The absence of an SSL certificate further increases risk, as user data submitted via this domain would be transmitted in plaintext. Security vendors have detected malicious activity, with 3 of 93 engines on VirusTotal flagging the domain, and it appears on at least one security blocklist. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or proxy level. Given the use of Cloudflare infrastructure, additional scrutiny of related domains sharing the same IP or nameservers is recommended. The exact phishing kit or payload is not yet analyzed, but the domain’s structure and branding align with known fraudulent stamp sale schemes targeting financial or personal data.