Phishing detection: autoconfig.uspsfund.online

USPS
https://autoconfig.uspsfund.online Access site
Screenshot
Screenshot of autoconfig.uspsfund.online
Investigate
Domain autoconfig.uspsfund.online10 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 173.211.81.11
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://autoconfig.uspsfund.online
urlscan Wayback archive.today
Cert YR1
crt.sh Censys Google CT
Phishunt analysis Beta
43 high suspicion likely_phishingheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +4.1 Brand in screenshot
  • +4.1 Site cluster
  • +4.0 Young domain
  • +3.7 Brand in domain label
  • +3.4 Cert reuse
  • +3.4 Shared IP cluster
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.9 Suspicious TLD
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Login text in screenshot
  • +0.6 Registrar reputation
  • +0.5 Long domain
  • +0.3 Free CA
  • +0.1 Deep subdomain
23 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Autoconfig subdomain of a newly registered USPS-themed 'fund' domain, with USPS branding in the screenshot text and a Google Safe Browsing flag. Shares an IP and certificate cluster with sibling hosts in the same campaign.

Brand in screenshotYoung domainCert reuse
AI-generated from stored detector signals - the AI never visited the site. · 2026-11-04 · confidence 65%
Domain & Network
Whois
Registrar Ultahost, Inc.
Network
IP 173.211.81.11
Country United StatesUnited States
Hosting Latitude.sh
ASN AS396356
TLS Cert YR1
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-11-04 17:19 UTC  ·  Last refreshed 2026-11-04 17:30 UTC