Mediumscore 39 · flagged Monday, August 31, 2026

usps.support

Appeared in the .support zone on Monday, August 31, 2026; by the end of that day the census found redirects elsewhere. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: usps
+10
brand name at a retail registrar
matched: Dynadot Inc
+8
brand name at a watch-list registrar
matched: Dynadot Inc
+6
brand name and brand-styled page
matched: usps
+15
Registrar
Dynadot Inc
Nameserver provider
Nameservers
ns1.dyna-ns.net, ns2.dyna-ns.net
First-day state
redirects elsewhere
HTTP status
200
Page title
USPS.com FAQs
Has a form
no
Brand echoed
usps

Model opinions

Second opinionsuspicioustarget: USPSconfidence 62%· claude-opus-5

usps.support is an exact-brand name in a support-themed TLD registered at a retail registrar (Dynadot) with generic dyna-ns nameservers — not the corporate registrar/DNS USPS uses — and it serves no content of its own, only a 302 to the genuine faq.usps.com, the classic reputation-aging pattern before a support-scam or parcel-phish swap; no credential capture is visible yet, so the evidence stops short of phishing.

First passlooks like abusetarget: USPSconfidence 85%· claude-haiku-4-5

usps.support is a typosquat domain (USPS brand in name, .support TLD mimicking a support subdomain) registered via Dynadot with nameservers dyna-ns.net, redirecting to legitimate USPS FAQ content. The redirect masks the typosquat's true purpose: capturing traffic from users seeking USPS support via a spoofed domain, likely for phishing or credential harvesting campaigns downstream. The domain serves no independent content and exists solely to impersonate USPS's support infrastructure.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

Same data as JSON: /api/zone/domain/usps.support. This page is not indexed by search engines and does not link to the site it describes.