During the holiday season, it is estimated that 800M packages are shipped via USPS between Thanksgiving and Christmas. Given these types of numbers, is it any wonder why scammers want to capitalize? With so many people expecting packages, a phishing attempt could easily work against an unsuspecting victim.

In one recent campaign identified by GoSecure Email Security Analysts, GoSecure Secure Email Gateway blocked almost a million phishing attempts against GoSecure clients. Here are a couple examples of recent attempts and how you can spot the scams.


Example #1: Maldoc Phishing Attempt

The first example below is a maldoc attempt. Here, the email seems to be indicating that the receiver has a package on the way but it was not able to be delivered.


The attached .iso file is an archive file which contains a file titled Delivery Pdf Doc.exe – this file when tested appears to reach out to hxxps://fetiqa[.]bl.files[.]1drv[.]com/ in order to download a malicious payload. The download site appears dead as of now so we are not sure what the payloads intention was, but rest assured, it was nothing good.

This type of maldoc is called a Trojan Downloader–the malicious payload is not attached to the email itself.

  • It is important to note on any email the entire FROM header: “usps customer support” <ups@delivery30k.com> – delivery30k.com is not a legitimate domain name, any notification like this should come directly from a retailer where an item was purchased or from a legitimate delivery service such as usps.com, ups.com, dhl.com, etc.
  • Any attachment to an email of this sort would be a .pdf file and nothing else. If you see any other type of file extension, there is cause for suspicion and it should not be downloaded or opened. If it is a .pdf file it should contain all of the information you need, if it is a link to somewhere else then DO NOT CLICK.


Example #2: Phishing Email with Phony Link

This example is a phishing attempt, where the scammer is trying to get the user to click on the link below to share personal information.


In this case the “Deliver My Package” link went to a USPS branded website:



As you can see in the original email there is a supposed $1.99 re-delivery fee. So, the scammer is trying to not only get your personal information, but to steal your credit card information as well.

  • On any email, check the FROM header. In this case the entire: usps <support@xxxsers.xyz>- xxxsers.xyz is not a legitimate domain name.
  • Any notification like this should come directly from a retailer where an item was purchased or from a legitimate delivery service such as usps.com, ups.com, dhl.com, etc.
  • It is also important to realize that USPS or other big delivery services DO NOT CHARGE for re-delivery.
  • Be sure check the tracking number given on the original email to ensure it is a valid delivery.



The key to protecting yourself and your users this holiday season is awareness. At GoSecure, we offer an extra layer of support with our GoSecure Titan Inbox Detection & Response (IDR) service which allows users to easily send suspicious email for professional evaluation right from the inbox. With the quantity of these scams, security teams are swamped trying to keep up with the volume of questionable emails from both email security filters and employee submissions. GoSecure IDR can help take away that burden. The IDR tool combines machine learning with our experienced analysts to review the email submitted and either return those messages that are safe or remove them from the entire domain if they are malicious.

To learn more about GoSecure Titan IDR, check out this webpage. And be sure to follow us on Twitter and LinkedIn for more investigations and cybersecurity news.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (Managed SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Secure Email Gateway (SEG)

GoSecure Titan® Threat Modeler

GoSecure Titan® Identity

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations


GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment


Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy


Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform


GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Security Information & Event Monitoring (SIEM)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence


Proactive Defense, 24/7


GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.





 24/7 Emergency – (888)-287-5858