How to find hundreds of phishing domains and IPs from just two text messages.
In this post, I’ll walk you through using Validin’s DNS history and enrichment capabilities to investigate a common smishing scam: text messages declaring that your package cannot be delivered due to incomplete address information. You’ll see how Validin can reveal a mountain of infrastructure from a sliver of ground truth in just a few minutes of searching. I’ll conclude with a list of high-confidence samples of current and recently-active domains and IPs.
How it Started
Earlier this month, I received two USPS package tracking smishing (SMS phishing) texts.
Both messages arrived via an RCS group chat from an out-of-country area code - 63 (associated with telephone numbers in the Philippines).
Let’s get the domain behind the second text message. We need to unpack that URL-shortened link without visiting the site. I quickly found the following to preview and view stats about the shortened URL:
- https://free-url-shortener.rb.gy/stats
- https://app.rebrandly.com/public/links/share?href=rb.gy/30yojn
Here, I note a few things:
- The favicon is the USPS logo (or something very similar)
- The site has received hundreds of clicks, nearly all from Android mobile devices
- Most of the clicks are from the day before I received the message
- Most of the clicks are in the US and Canada (which makes sense for a USPS package tracking scam)
The destination domain resembles “usps.com”: usabns[.]com.
With these two domains, let’s explore the infrastructure and see what we can discover!
Initial Pivots
Starting with the first domain, nj-hsoysb[.]top, I see that the domain is relatively new. Validin’s first scan was the morning of the 7th:
The domain resolves to one IP. Exploring that lone IP, hosted on Alibaba, yields 63 additional hosts dating back to 19 January 2024 for domains with similar naming conventions:
There are two domains on that list that are possibly unrelated: dlirecitwveb-la[.]com and its “www.” subdomain (potentially abandoned domain names - a topic for another blog post).
Sorting the resolutions by first seen allows us to see the progression of these domains’ activations:
We observe that the actor uses geographic themes in their domain names (Hagerstown, MD, USA, and Warren, PA, USA):
Second-order Pivoting
Let’s look at some domains that no longer resolve to 47.90.178[.]8:
Wildcard searches for each of these domains reveal two new potential IP pivots:
We can continue revealing new domains and IP addresses matching the original parcel-tracking phishing theme with just DNS pivots.
Advanced Pivoting
Wouldn’t detecting these domain owners’ tooling and techniques be great? Validin fingerprints hundreds of millions of endpoints daily, enabling additional pivoting methods from this broad and encompassing vantage point. Let’s look at the host responses captured by Validin for the original domain names, nj-hsoysb[.]top and usabns[.]com:
Validin summarizes pivots extracted from host responses in the “Host Connections” tab:
Let’s pivot through the HOST-HEADERS_FINGERPRINT value ef811b2b6138cfdd5f3c
. We see over 10,000 results on the enterprise platform, so we’ll narrow the search to see if we can uncover additional related infrastructure. We filter out IPs and focus on top
domains and get 962 recent results:
With this filter, tracking the host response fingerprint, we see apparent themes in the domain names. With additional validation and cleanup, we can generate an extensive list of suspicious domains and track new ones as they’re activated.
We’ve aggregated some of the domains at the end of this post.
Conclusion
Pivoting through historic DNS enables you to quickly learn of a domain or IP history, understand activity patterns, and discover new infrastructure. Validin enables these use cases by actively tracking domain name resolution history at a broad scale regardless of popularity.
Further, Validin can identify and track additional behavior and tooling, enabling rapid discovery and tracking of tooling patterns. Validin’s range filters enable you to hone in on specific points in time and dimensions, enabling unique insights into these tooling patterns.
Interested in leveraging Validin to build threat intelligence proactively? Check out our individual pricing and plans, or contact us to learn about our enterprise options.
47.90.156[.]21
47.90.178[.]8
47.253.112[.]183
expresss[.]cc
usfacai.expresss[.]cc
usps.postalaa[.]com
usps-send-a[.]com
usps-package-a[.]com
usps-sending-a[.]com
usps-tracking-a[.]com
usps-track-a[.]com
usps.uspsshipchecka[.]com
usps-click-a[.]com
dlirecitwveb-la[.]com
usps-info-a[.]com
usps-ship-a[.]com
usps.uspsshipa[.]com
usps-help-a[.]com
warren-pa[.]com
usps-packages-a[.]com
usps.postva[.]com
uspsxva[.]com
usps.postxa[.]com
usps.gggeebb[.]com
usps.postalasb[.]com
usps.shippingusb[.]com
usps.gggeeec[.]com
uspsqwec[.]com
usps.uspslmc[.]com
usps.uplspc[.]com
usps.uspspc[.]com
usps.postheypc[.]com
usps.norsensc[.]com
usps.checkuspsc[.]com
usps.shippingusc[.]com
usps.uspsxxc[.]com
usps.cyyc[.]com
checkuspszc[.]com
usps.address-correct-upload[.]com
usps.aaadhdgd[.]com
usps.uspsshippingd[.]com
usps-shipsend[.]com
usps-help-send[.]com
usps-helpsend[.]com
usps-toolssend[.]com
ksudsd[.]com
usps.shippingusd[.]com
uspdeliveryservice[.]com
postparsce[.]com
uspsagree[.]com
uspsexchange[.]com
usps-sending-e[.]com
uspxie[.]com
usps.uspxie[.]com
usp.wordartine[.]com
usps-info-e[.]com
usps.uspsshfpre[.]com
usps.uspsshipre[.]com
usps.datarenewe[.]com
usps.postalaf[.]com
usps.gggweef[.]com
usps.ghdjf[.]com
usps.gggrrerf[.]com
usppkg[.]com
amzceng[.]com
ammeng[.]com
amrmeng[.]com
amrneng[.]com
amrseng[.]com
amrveng[.]com
amrweng[.]com
amrxeng[.]com
usps-update-sending[.]com
usps-info-sending[.]com
usps-helpsending[.]com
usps-helptracking[.]com
usps-usmailprocessing[.]com
usps.uspsshipg[.]com
usps.checkuspsg[.]com
uskwsg[.]com
usps.kcioelsopeaderudgh[.]com
usps.postalash[.]com
usps.checkuspsh[.]com
usprsh[.]com
usps.teamtcpei[.]com
usps.teamtrpei[.]com
usps.postalasi[.]com
usps.postalasj[.]com
usps.postvj[.]com
kkszak[.]com
usps-help-track[.]com
usps.uspsshipcheck[.]com
usps-sendchick[.]com
usps-help-click[.]com
usps.checkuspsk[.]com
usps.postsaal[.]com
usps-real[.]com
uspsoptimal[.]com
usp.poestal[.]com
usps.postsacl[.]com
usps.uspsxcl[.]com
usps.postsadl[.]com
usps.postsael[.]com
usp-parcel[.]com
usps.postsafl[.]com
usps.postafl[.]com
usps.postsagl[.]com
usps.postgl[.]com
usps.posthl[.]com
usps.postsajl[.]com
usps.postsakl[.]com
usps.ocpxll[.]com
usps.postsaml[.]com
usps.postsanl[.]com
usps.postsaol[.]com
usps.postsapl[.]com
usps-help-l[.]com
usps.postsaql[.]com
usps.postsarl[.]com
usps.usprl[.]com
usps.postrl[.]com
usps.postasl[.]com
usps.poatsl[.]com
usps.pobtsl[.]com
usps.poctsl[.]com
usps.podtsl[.]com
usps.pogtsl[.]com
usps.pohtsl[.]com
usps.pojtsl[.]com
usps.poktsl[.]com
usps.pomtsl[.]com
usps.pontsl[.]com
usps.postsl[.]com
usps.povtsl[.]com
usps.poxtsl[.]com
usps.poztsl[.]com
usps.postsatl[.]com
usps.posttl[.]com
usps.postsaul[.]com
usps.postsavl[.]com
usps.uspsmvl[.]com
usps.postwl[.]com
usps.postsaxl[.]com
usps.postsayl[.]com
usps.postsazl[.]com
usps.postazl[.]com
usps.postalam[.]com
usathm[.]com
usps-sendingspm[.]com
usps.usprm[.]com
ksudsm[.]com
checkuspsm[.]com
usps.checkuspsm[.]com
usps.postvm[.]com
usps.uspslxm[.]com
usps.uspsxxm[.]com
usps.postkln[.]com
usps.aaammnn[.]com
usps.gbation[.]com
usps.ghation[.]com
usps.gjation[.]com
usps.gkation[.]com
usps.gpation[.]com
usps.gwation[.]com
usps.gzation[.]com
usps.gjction[.]com
usps.grction[.]com
usps.gvction[.]com
usps.gzction[.]com
usps.gldtion[.]com
usps.grdtion[.]com
usps.gdetion[.]com
usps.gketion[.]com
usps.gtetion[.]com
usps.gvetion[.]com
usps.gkition[.]com
usps.gnjtion[.]com
usps.gpltion[.]com
usps.gzltion[.]com
usps.glmtion[.]com
usps.ghntion[.]com
usps.glntion[.]com
usps.gdotion[.]com
usps.gdption[.]com
usps.gvption[.]com
usps.gwqtion[.]com
usps.gbrtion[.]com
usps.gfrtion[.]com
usps.gfstion[.]com
usps.gbvtion[.]com
usps.gjvtion[.]com
usps.gnvtion[.]com
usps.gcxtion[.]com
usps.gnxtion[.]com
usps.grxtion[.]com
usps.gbytion[.]com
usps.gcztion[.]com
usps-hagerstown[.]com
us-hagerstown[.]com
m.us-hagerstown[.]com
usps.uspsxxn[.]com
usps.ulpcbo[.]com
usps-helpsend-info[.]com
usps-sending-info[.]com
usps-tracking-info[.]com
usps-trackinginfo[.]com
usps-help-info[.]com
usps.postalaso[.]com
usps.ulpcvo[.]com
dhlcp[.]com
usps-sendship[.]com
tacking-usps-vip[.]com
usps-sendinghelp[.]com
usps-tracking-help[.]com
usps-packages-help[.]com
uspplolp[.]com
usps.postalasp[.]com
usps.postalasq[.]com
ksudsq[.]com
usps.posthelpnir[.]com
tracking-pack-uspir[.]com
uspstwr[.]com
usps.postalas[.]com
checkuspsas[.]com
uspdeliveries[.]com
usps-posta-lexpres[.]com
usps-us-postalexpres[.]com
usps-expres[.]com
uspostexpres[.]com
usps.posthelpnis[.]com
usps.trackpacks[.]com
usps-receivetools[.]com
usps-tracktools[.]com
08us6g012ps[.]com
08us6g003ps[.]com
08us6g023ps[.]com
08us6g004ps[.]com
08us6g025ps[.]com
08us6g026ps[.]com
08us6g027ps[.]com
08us6g028ps[.]com
usps.thedsihdhusps[.]com
ausaisusps[.]com
my-usps[.]com
usps-ups[.]com
usporders[.]com
uspsrs[.]com
ksudss[.]com
postalexpess[.]com
usps.confirmaddress[.]com
usporess[.]com
usps-postalexpress[.]com
usps-us-postalexpress[.]com
uspsxss[.]com
usps.tracking-posts[.]com
usps-posts[.]com
us-posts[.]com
usps.postvs[.]com
usps.uspsxxs[.]com
usps.ostmlot[.]com
usps.postalast[.]com
usps.postalau[.]com
usps.postalasu[.]com
usps.uspsmcv[.]com
usps.postnv[.]com
usps.postalsv[.]com
usps.postvv[.]com
usps.gggttvv[.]com
usps.postxv[.]com
usps.uspsxxv[.]com
usps.postiw[.]com
usps.postalasw[.]com
usps.iplcsw[.]com
uspszax[.]com
usps.upsmex[.]com
usps.posthelpnix[.]com
uspstrrx[.]com
usps.postvx[.]com
usps.uspsvvx[.]com
usps.uspsmzx[.]com
checkuspszx[.]com
germeany[.]com
us.booy[.]com
uusps.paintoverlaundry[.]com
usps.postalasy[.]com
usps.postalaz[.]com
usps.uspsxcz[.]com
uspsjkkz[.]com
usps.norsensz[.]com
usps.postvz[.]com
usps.uspslxz[.]com
usps.postxz[.]com
usps.uspsxxz[.]com
usps-postalexpress[.]vip
uspslog[.]shop
uspslign[.]shop
uspslogn[.]shop
usps.postalaa[.]top
usps.postaa[.]top
usps.address-servesca[.]top
usps.uspsshippinga[.]top
us-pennsylvania[.]top
usps-pr.helpia[.]top
usps.helpika[.]top
usps.rsnxhpla[.]top
warren-pa[.]top
warrenpa[.]top
sj.warren-pa[.]top
us-warrenpa[.]top
ksudsa[.]top
usps.address-servesa[.]top
uspstlsa[.]top
usps-pr.helpta[.]top
usps.address-serveswa[.]top
usps.address-servesab[.]top
usps.eeerrbb[.]top
usps.address-servescb[.]top
usps.posthomeib[.]top
usps.postheypb[.]top
ksudsb[.]top
usps.address-servesb[.]top
nj-hsoysb[.]top
usps.postvb[.]top
usps.hshwfhwbyb[.]top
usps-pr.homeac[.]top
usps.postalac[.]top
usps.eeeddcc[.]top
usps.aaarecc[.]top
usps.aaavfcc[.]top
usps.aaarrcc[.]top
usps.eeerrcc[.]top
usps.dddrrttcc[.]top
usps.eeevvdc[.]top
usps.address-serveshc[.]top
usps.posthelpric[.]top
usps.pmyklxic[.]top
usps.postnc[.]top
usps.address-servesqc[.]top
usps-pr.helptc[.]top
usps.address-servestc[.]top
usps.postsad[.]top
usps.postad[.]top
usps.aaamdhcd[.]top
usps.aaabbded[.]top
usps.lbyjtked[.]top
usps.xfnqqned[.]top
usps.yerojpbmgd[.]top
usps.address-servesgd[.]top
usps.dhdfhd[.]top
usps.nywkwawfid[.]top
usps.posthelpnid[.]top
usps.helpild[.]top
usps.address-servesnd[.]top
usps.address-servesd[.]top
usps.postvd[.]top
usps.eeegtxd[.]top
usps.address-servesyd[.]top
usps.helpizd[.]top
generalpostoffice[.]top
postparsce[.]top
tools.usps-code[.]top
usps.aaabbee[.]top
usps.aaaffccee[.]top
usps.aaawwee[.]top
usps.cjzswohe[.]top
usps.posthelprie[.]top
uspsusane[.]top
usps-pr.helpoe[.]top
usps.ookfvpoe[.]top
usps.posthomeire[.]top
usps.address-servese[.]top
usps-pr.helpte[.]top
postalservicemustarrive[.]top
usps.postve[.]top
usps.utsawe[.]top
usps.address-servesxe[.]top
usps.postaf[.]top
usps.uktkpgefbf[.]top
usps.address-servesef[.]top
usps.uspsshippingf[.]top
usps.address-servesgf[.]top
usps.sgdshf[.]top
usps.address-servesif[.]top
usps.address-servesjf[.]top
usps.helpikf[.]top
usps-pr.helpkf[.]top
usps.postnf[.]top
usps.oyfmoxof[.]top
usps.posthomeirf[.]top
usps.address-servesrf[.]top
usps.aqxjkffywf[.]top
usps.address-servesxf[.]top
usps.kkynelbg[.]top
usps.hsdsdg[.]top
usps.sdgdfg[.]top
usps.fdhshg[.]top
usps-pr.helpkg[.]top
usps.uspscheckshipping[.]top
uspslog[.]top
usps.address-servesg[.]top
usps.gsgfsg[.]top
usps.helptg[.]top
usps.helpostg[.]top
usps.address-serveszg[.]top
usps.postah[.]top
usps.helpch[.]top
usps.posthelprih[.]top
usps.fffjjjh[.]top
usps-pr.helpkh[.]top
usps.postalash[.]top
usps.address-servessh[.]top
usps.helposth[.]top
usps.postvh[.]top
usps.usnskiei[.]top
usps.helpili[.]top
usps.hrwyxili[.]top
usps.rkatnhpi[.]top
usp-spi[.]top
usps.posthomeiri[.]top
usps.wyfmtiri[.]top
usprsi[.]top
usps.address-servesui[.]top
usps.postvi[.]top
usps.helpizi[.]top
usps.address-servesaj[.]top
usps.postaj[.]top
usps.fmwlxxzxfj[.]top
usps.fffhjhj[.]top
usps.posthelprij[.]top
usps.address-servesjj[.]top
usps-pr.helpoj[.]top
usps.address-servespj[.]top
usps.address-servesrj[.]top
usps.kkcwjgjnsj[.]top
usps.helptj[.]top
usps.postvj[.]top
uspyj[.]top
usps.postak[.]top
usps.uspsshipcheck[.]top
usps.aaalklk[.]top
usps.mpkfgspk[.]top
usps.address-servesk[.]top
usps.tipzknsk[.]top
usps.helpostk[.]top
usps.postvk[.]top
usps.helpizk[.]top
usps.address-serveszk[.]top
usps-postal[.]top
usps.postal[.]top
usps.postsabl[.]top
usps.address-servesbl[.]top
usps.postsacl[.]top
usps.postsadl[.]top
usps.postsael[.]top
usps.postsagl[.]top
usps.postagl[.]top
usps.postsahl[.]top
usps.address-serveshl[.]top
usps.postsail[.]top
usps.postil[.]top
usps.nczsnkjnfcjl[.]top
usps.posjl[.]top
usps.postsakl[.]top
usps.aaaklkl[.]top
usps.iphtjdxjml[.]top
usps.postsanl[.]top
usps-pr.helpol[.]top
usps-pr.helpql[.]top
usps.postql[.]top
usps.postrl[.]top
usps.address-servesl[.]top
usps.pobtsl[.]top
usps.poctsl[.]top
usps.podtsl[.]top
usps.poftsl[.]top
usps.pohtsl[.]top
usps.pojtsl[.]top
usps.poktsl[.]top
usps.pontsl[.]top
usps.postsaul[.]top
usps.postul[.]top
usps.postsavl[.]top
usps.postavl[.]top
usps.postwl[.]top
usps.postsayl[.]top
usps.postam[.]top
usps.uayjjgcm[.]top
usps.gxsyndqvem[.]top
usps.address-servesfm[.]top
usps.skqpsjhohm[.]top
usps.posthomeim[.]top
usps.ymxwbgim[.]top
usps-pr.helpom[.]top
usps.qwpmcwrm[.]top
ksudsm[.]top
usps.address-servesm[.]top
usps.helptm[.]top
usps-ordernum[.]top
usps.cywejncn[.]top
usps.gvahxpneen[.]top
usps.ghjtion[.]top
usps.guotion[.]top
usps.grption[.]top
usps.gxstion[.]top
usps.gnvtion[.]top
usps.gtvtion[.]top
usps.gxvtion[.]top
usps.address-servesn[.]top
usps-pr.helpsn[.]top
usps.gfbvn[.]top
us-hagerstown[.]top
usps.address-servesxn[.]top
usps.address-servesfo[.]top
usps-go[.]top
usps.address-servesho[.]top
usps-pr.helpio[.]top
usps.address-serveslo[.]top
usps.msvcoro[.]top
usps.postalaso[.]top
usps-pr.helpso[.]top
usps.address-servesso[.]top
usps.helpto[.]top
usps.address-servesto[.]top
usps.postvo[.]top
usps.address-serveswo[.]top
usps.address-servesbp[.]top
usps.address-servesgp[.]top
usps.address-serveskp[.]top
uspspost-help[.]top
usps.buwnecop[.]top
usps.posthomeirp[.]top
usps.postalasp[.]top
usps.address-servesp[.]top
usprsp[.]top
usps.com.fdhgsfggroup[.]top
usps.helpizp[.]top
usps.address-serveszp[.]top
usps.jwpeyqbq[.]top
usps-pr.helphq[.]top
usps.address-serveshq[.]top
usps.address-servesiq[.]top
usps.zwgadziq[.]top
usps.address-serveskq[.]top
usps-pr.helppq[.]top
usps-pr.helpsq[.]top
usps.address-servestq[.]top
usps.helpostq[.]top
usps.utsawq[.]top
usps.address-serveswq[.]top
usps-pr.homear[.]top
usps.rstmylar[.]top
usps.rztmylar[.]top
usps.lwrketer[.]top
usps.waiiiajr[.]top
usps.helpikr[.]top
usps.address-serveskr[.]top
usps.hyxuolor[.]top
usps.eeehhrr[.]top
usps.address-servesr[.]top
usps.address-servesur[.]top
usps.postvr[.]top
usps-pr.helpwr[.]top
usps.address-serveswr[.]top
usps.lpfhjmxr[.]top
usps-uspsgcas[.]top
uspsavncas[.]top
usps.zmwsyeas[.]top
usps.postalas[.]top
usps.rstmylas[.]top
usps-uspsgvas[.]top
usps.aaarecds[.]top
postexpres[.]top
uspostexpres[.]top
usps-postes[.]top
tools.usps-postes[.]top
usps.eeetyfs[.]top
usps.address-servesms[.]top
uspsnvans[.]top
usps.address-servesns[.]top
usps.address-servesos[.]top
usps.useups[.]top
tracpsusp.uhuups[.]top
usps.postsass[.]top
uspeess[.]top
postalexpess[.]top
usps.postalexpess[.]top
uspsst-postalexpress[.]top
uspspostexpress[.]top
us-postexpress[.]top
uspopeots[.]top
usps-posts[.]top
usps.uspssavs[.]top
uspsaecvs[.]top
usps.uspsaecvs[.]top
usps.uspsgcvs[.]top
uspsascvs[.]top
usps.uspsascvs[.]top
uspvs[.]top
usps.postvs[.]top
usps.usgsuvs[.]top
usps.helpizs[.]top
usps.wkbdlrlaat[.]top
usps.address-servesct[.]top
usps.address-serveset[.]top
usps.helpit[.]top
usps.posthelprit[.]top
usps.address-servesmt[.]top
usps-pr.helpcrt[.]top
usps.posthomeirt[.]top
usps.address-servesrt[.]top
usps.postalast[.]top
deutscchepost[.]top
usps-post[.]top
usps.aaaggtt[.]top
usps.postvt[.]top
usps.quongrbu[.]top
usps.address-servesbu[.]top
usps.posthomeiru[.]top
usps.msvcoru[.]top
usps.postalasu[.]top
usps.address-servesu[.]top
usps.postalav[.]top
usps.address-servesav[.]top
usps.postav[.]top
usps.nesxcv[.]top
usps.posthelpriv[.]top
usps-pr.helpkv[.]top
usps-pr.helpov[.]top
usps-pr.helptv[.]top
usps.address-servestv[.]top
usps.postvv[.]top
usps.aaawwvv[.]top
usps.address-serveswv[.]top
usps.keotnlyv[.]top
usps.helpizv[.]top
usps.zlnvjuaw[.]top
usps-pr.helpbw[.]top
usps.address-servesdw[.]top
usps.posthelpriw[.]top
usps.postiw[.]top
usps.shuivwow[.]top
usps.ecogqtecrw[.]top
usps.msvcorw[.]top
usps.postalasw[.]top
usps.address-servesw[.]top
usps-pr.helpsw[.]top
usps.helptw[.]top
usps.postvw[.]top
usps.postax[.]top
usps.postbx[.]top
usps-pr.posthelpscx[.]top
usps-pr.helpdx[.]top
usps.address-servesdx[.]top
usps.address-servesgx[.]top
usps.address-servesjx[.]top
usps-jx[.]top
usps.address-servekx[.]top
usps.address-serveslx[.]top
usps.address-servesox[.]top
usps.egntairx[.]top
usps.postsasx[.]top
usps-pr.helpsx[.]top
usps.address-servessx[.]top
uspsusatx[.]top
usps-pr.helptx[.]top
usps.address-servesux[.]top
usps.postvx[.]top
usps.helpizx[.]top
delivered-today[.]top
usps-pr.helpcy[.]top
usps-pr.helpiy[.]top
usps.helptiy[.]top
usps.address-servesky[.]top
usps.address-servesoy[.]top
courierdelivery[.]top
efficientdelivery[.]top
usps.posthomeiry[.]top
usps.postalasy[.]top
usps.address-servesy[.]top
usps.address-servessy[.]top
usps.address-servesty[.]top
usps.address-servesuy[.]top
usps.postvy[.]top
usps.aaattrryy[.]top
usps.postalaz[.]top
usps.ddmylaz[.]top
usps.postaz[.]top
usps.address-servesez[.]top
usps.address-serveslz[.]top
usps.posthomeirz[.]top
usps.lgamumvqrz[.]top
usps.postalasz[.]top
usps.address-servesz[.]top
usps.address-servesuz[.]top
usps.postvz[.]top
usps.kinaghwz[.]top
usps.sucxz[.]top
usps.address-servesxz[.]top
uspsdelivered[.]cyou
postaldelivery[.]cyou
expressdelivery[.]cyou
same-daydelivery[.]cyou
usps.aupse[.]xyz
uspslog[.]xyz
uspslign[.]xyz
uspslogn[.]xyz
usspees[.]xyz
usps.lleups[.]xyz
postalexpress[.]xyz