“Alas, running a search for domains registered through Alibaba to anyone claiming to reside in Georgia, AL reveals nearly 300 recent postal phishing domains ending in “.top.””
The fake USPS page leaked the real USPS Google Analytics code, and that code ties the operation to phishing pages going back to 2018. Nearly 300 postal phishing domains list a registrant in “Georgia, AL,” a place that does not exist, and Alibaba registered them anyway. The stolen data goes to a Telegram bot run by a seller of phishing kits. Registrars collect the fees and never check the address.