ACSC Logo
© GEMXIT
GEMXIT Logo
Email Security • URL Mismatch • Microsoft Defender XDR

The Link Said USPS - The URL Told A Different Story

The subject looked simple enough.

Uncollected package. Action required.

But the email did not behave like a normal parcel notification. It claimed to be from USPS, used an Outlook sender, carried a strange Exchange address, mixed Australia Day newsletter content with package delivery urgency, and displayed a trusted tracking link that actually pointed somewhere else.

Discuss phishing investigations Back to briefings
Agent Foskett Microsoft Defender XDR USPS phishing URL investigation
Briefing summary

A fake package delivery email showed a trusted USPS tracking address to the user, but the underlying destination pointed to a suspicious non-USPS domain. Agent Foskett followed the sender, subject, HTML and URL evidence to work out what the email was really trying to do.

Display Brand = USPS.COM
Sender = Outlook.com
Visible Link = usps.com/tracking
Actual URL = Suspicious Domain

The email looked like a delivery notice

The subject created urgency, but the body contained clues that did not belong together.
Uncollected package The message claimed a package could not be delivered and would be returned to sender unless the recipient replied or reviewed the package.
Australia Day content The HTML also contained a newsletter about Australia Day, kangaroos, emus and the dingo fence. That content did not match a USPS package alert.
Template reuse The attacker appeared to reuse or corrupt an existing marketing template, then insert the package delivery lure into the middle of it.

The first red flags

Agent Foskett did not start with the branding. He started with the contradictions.
The sender was not USPS The visible brand said USPS.COM, but the sender address was an Outlook mailbox: kidydzzib486@outlook.com.
The routing looked strange The message included a long IMCEAEX style address, which is not something a normal user should rely on when deciding whether an email is genuine.
The geography was wrong A USPS package notification mixed with Australia Day marketing content is not a normal business communication pattern.

The KQL investigation

Start with the message record. Confirm the sender, recipient, subject, verdicts and delivery outcome.
usps-phishing-email-search.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
EmailEvents
| where Timestamp > ago(30d)
| where Subject has_any ("Uncollected package", "action required", "745730505")
    or SenderFromAddress has "outlook.com"
| project
    Timestamp,
    SenderFromAddress,
    SenderMailFromAddress,
    RecipientEmailAddress,
    Subject,
    ThreatTypes,
    DeliveryAction,
    DeliveryLocation

The link was the story

The visible text said one thing. The destination said something else.
What the user saw The body displayed https://www.usps.com/tracking, which appears to be a legitimate USPS tracking address.
Where it really went The actual destination pointed to cwwhv[.]login-baoweisports[.]com, not usps.com. That mismatch is the core phishing clue.
Why it matters Users often read the visible link text. Defenders must inspect the actual URL recorded in email and click telemetry.

Extracting URLs from the email

EmailUrlInfo helps reveal the URLs that were actually present in the message.
email-urlinfo-usps-mismatch.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
EmailUrlInfo
| where Timestamp > ago(30d)
| where Url has_any ("usps", "login-baoweisports")
| project
    Timestamp,
    NetworkMessageId,
    Url,
    UrlDomain
| order by Timestamp desc

Did anyone click?

A suspicious email is one thing. User interaction changes the incident priority.
usps-url-click-investigation.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
UrlClickEvents
| where Timestamp > ago(30d)
| where Url has_any ("usps", "login-baoweisports")
| project
    Timestamp,
    AccountUpn,
    Url,
    ActionType,
    Workload,
    IPAddress

What the attacker wanted

Parcel delivery scams work because they combine familiarity, urgency and a small action request.
Reply with address details The email asked the recipient to reply with the correct shipping address. That can harvest personal information without needing a complex malware payload.
Click the tracking link The displayed USPS link encouraged trust, while the hidden destination could lead to credential theft, payment fraud or further redirection.
Use urgency The warning that the package would be returned pressures the user to act quickly instead of inspecting the sender and URL carefully.

Campaign scope

One reported email may be part of a wider delivery campaign across multiple recipients.
usps-phishing-campaign-scope.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
EmailEvents
| where Timestamp > ago(30d)
| where Subject has_any ("Uncollected package", "USPS", "745730505")
    or SenderFromAddress has "kidydzzib486"
| summarize
    TotalMessages = count(),
    Recipients = dcount(RecipientEmailAddress),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by SenderFromAddress, SenderIPv4, DeliveryAction

Agent Foskett moment

The branding was not the evidence. The mismatch was.
The email was stitched together Australia Day content, broken HTML and package delivery warnings suggested a reused or modified template rather than a clean official notification.
The sender did not match the brand A genuine USPS message should not rely on a random Outlook sender pretending to be USPS.COM.
The link told the truth The visible text said USPS. The underlying destination did not. That is where the investigation turned from suspicious to malicious.

Questions every analyst should ask

When an email displays one link but sends the user somewhere else, the investigation should move quickly from inbox review to telemetry.
What did the user see? Record the display text, brand, subject line and call to action so the social engineering technique is understood.
Where did the link point? Use EmailUrlInfo, message headers and Safe Links evidence to identify the real URL and domain behind the display text.
Did anyone interact? UrlClickEvents can show whether the recipient clicked, whether Defender allowed or blocked the visit, and whether further response is needed.

Related investigations

The User Reported The Email — But It Was Already Gone Investigate what happened when a suspicious message disappeared before IT could review it. Read more →
The Email Passed SPF, DKIM and DMARC — Why Did Composite Authentication Still Fail? Learn why authentication results can be more complex than simple pass or fail values. Read more →
The Link Was Clicked After The Email Was Delivered Use Defender XDR click evidence to investigate user interaction after delivery. Read more →
UrlClickEvents Use Defender XDR URL click telemetry to investigate who clicked suspicious links. Read more →
Investigating EmailAuthenticationResults in Microsoft Defender XDR Understand how authentication evidence helps explain whether a message deserved trust. Read more →
The Recipient Was Unrecognised See how a Microsoft 365 bounce message exposed a suspicious payment receipt scam. Read more →
The link looked safe.
But the destination told the real story. That is why defenders inspect the URL behind the words.
Contact GEMXIT

Final thought

A phishing email does not need to be perfect. It only needs one rushed user to trust the visible text.
At GEMXIT We help organisations investigate Microsoft Defender XDR, phishing, spoofing, Safe Links, email authentication and practical threat hunting. If you want to understand how this applies to your environment, see our Microsoft Security services.
Agent Foskett mindset Do not trust the visible link text. Inspect the actual destination, compare it to the claimed sender and then check whether any user clicked.

The subject said uncollected package. The brand said USPS. The link text said tracking. The real URL said something else. Explore related investigations including UrlClickEvents, post-delivery click analysis, and EmailAuthenticationResults.

Develop IT. Protect IT. GEMXIT PTY LTD | GEMXIT UK LTD
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The Link Said USPS The URL Told A Different Story

This Agent Foskett investigation explains how a fake USPS package delivery email used trusted visible link text while pointing the recipient to a suspicious external domain.

Microsoft Defender XDR Phishing URL Investigation

Microsoft Defender XDR, EmailEvents, EmailUrlInfo, UrlClickEvents, ThreatTypes, DeliveryAction and DeliveryLocation can help analysts investigate phishing emails, sender deception, URL mismatch and user clicks.

USPS Package Delivery Phishing Email Investigation

Parcel delivery phishing emails often use urgency, fake tracking links, mismatched sender domains and reused HTML templates. Analysts should inspect both the visible link text and the real URL destination.