Phishing detection: bn.usps.cash

USPS
https://bn.usps.cash Access site
Screenshot
Screenshot of bn.usps.cash
Investigate
Domain bn.usps.cash2 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 34.149.87.45
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://bn.usps.cash
urlscan Wayback archive.today
Cert Let's Encrypt
crt.sh Censys Google CT
Phishunt analysis Beta
29 low suspicionheuristic risk score · not a probability
Keyword matchurlscan.ioASN reputation
17 signals fired · detector v2.0.0
AI analysis AIBeta
Delivery scam

Site impersonates USPS on a fraudulent cash-TLD domain and belongs to a coordinated multi-language cluster of subdomains all resolving to the same Google Cloud IP. It appears to harvest personal or payment details under a package delivery pretext. Confirmed malicious by urlscan.

Keyword matchShared IP clusterurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-18 · confidence 82%
Domain & Network
Whois
Registrar Amazon Registrar, Inc.
Network
IP 34.149.87.45
Country United StatesUnited States
Hosting Google LLC
ASN AS396982
TLS Cert Let's Encrypt
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Related infrastructure Betasuspected links from shared infrastructure, not attribution
Suspected cluster #42 · 10 indicators · confidence High · targets: USPS
ar.usps.cash 65 similar text same apex same nameservers same redirect target same favicon same screenshot
active 2026-07-17
de.usps.cash 65 similar text same apex same nameservers same redirect target same favicon same screenshot
active 2026-07-17
es.usps.cash 65 similar text same apex same nameservers same redirect target same favicon same screenshot
active 2026-07-17
fr.usps.cash 65 similar text same apex same nameservers same redirect target same favicon same screenshot
active 2026-07-17
he.usps.cash 65 similar text same apex same nameservers same redirect target same favicon same screenshot
active 2026-07-17
Top 5 of 9 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Google LLC
Web form
Registrar Amazon Registrar, Inc.
abuse@amazon-registrar.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-17 13:59 UTC  ·  Last refreshed 2026-07-21 01:30 UTC