diff --git a/filters/badware.txt b/filters/badware.txt
index 5cfea262df1..12b525e127e 100644
--- a/filters/badware.txt
+++ b/filters/badware.txt
@@ -3672,6 +3672,7 @@ torrdroidforpc.com##[href^="http://slugmefilehos.xyz/"]
 ||dalobatter.com^$all
 ||skae3299.top^$all
 ||yenrtonm3367.top^$all
+||signup-amazon.com^$all
 ||ecommrce-web-amazon.netlify.app^$all
 ||etisalat-amazonprime.com^$all,to=~etisalat.ae
 ! https://infosec.exchange/@urldna/112483094476417201
@@ -5866,7 +5867,8 @@ webflow.io##html.w-mod-js:not(.wf-active) > body:not([class]):not([id]) > a[clas
 ! https://www.reddit.com/r/Scams/comments/1gppxs5/package_is_detained_scam/
 ! https://www.reddit.com/r/Scams/comments/1gpo2x6/is_this_a_scam_seems_kinda_sketchy/
 ! https://www.reddit.com/r/Scams/comments/1grey9a/is_this_actually_usps_or_a_scam/
-||usps.com-$doc,to=live|vip|~usps.com
+! https://www.virustotal.com/gui/url/7d78e3dd3c6dbb1eeb8a916a3fa87f8235d374691d35d90afc330182a18fc766
+/^https:\/\/usps\.com-(?:\w+\.){1,2}[a-z]{2,4}\//$doc,to=~com|~net|~org|~edu|~gov
 
 ! https://github.com/uBlockOrigin/uAssets/issues/26052
 ||orcaslicer.info^$doc