Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
Social Engineering Examples·3 sources
In June 2026, researchers at Censys published how they mapped a live text-message scam posing as USPS package alerts. Starting from one reported link, they traced 682 lookalike web addresses back to a small cluster of servers. The fake site copied the real USPS website down to its fonts and analytics, and sent victims' card details to the scammers as they typed, before they even pressed submit. A sister campaign posed as UPS. Status: Researcher investigation, no loss figures.
| Step | What happened |
|---|---|
| Text | A message says a USPS (or UPS) package needs action, with a link |
| Fake site | A page that reuses USPS's real fonts, styles, images and even its analytics tags |
| Live capture | A hidden connection streams each keystroke to the scammers, before the form is submitted |
| Card check | The scammers' server looks up the card's bank details in real time |
| Kill switch | Operators can bounce any visitor to the real usps.com, likely to dodge researchers |
Censys logged 279 of these live messages across seven captured sessions. A UPS-themed version ran on separate servers but shared an internal label, "us_post_ups", linking the two.
Tip: if a text says a parcel needs action, open the carrier's app or type its website yourself and enter the tracking number. Never use the link.
Instead of one fake site, the scammers rotated through hundreds of throwaway web addresses. Censys found them using historical DNS records, which show which names pointed where and when.
| Pattern | Count |
|---|---|
| *.life | About 334 |
| informed.deliwek*.shop | About 250 |
| usps.xupq*.one | 78 |
| deliwek*.shop | 17 |
| xupq*.one | 3 |
All of them led back to servers on Tencent Cloud in two address ranges. Publishing these shared fingerprints lets defenders, registrars and hosts block the whole cluster at once rather than one site at a time. No arrests have been tied to this kit.
At a June 2025 briefing in Tampa, USPS and the Postal Inspection Service were clear: USPS doesn't send unsolicited text messages, and USPS texts never include links. So any "USPS" text with a link is fake, however real the website looks. This is classic smishing.
See also the toll-road smishing wave and the QR code package scam.
No. USPS says it doesn't send unsolicited texts, and its texts never include links.
It copied USPS's actual website files, including fonts, images and analytics, so it looked and behaved like the real thing.
With this kit, the details were already sent as you typed. Contact your bank and cancel the card.
Neither Censys nor USPS has published a victim count or loss figure for this kit.
Social Engineering Examples. “USPS and UPS package smishing kit exposed through DNS data (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/usps-ups-package-awaiting-action-smishing-kit-censys-2026
Consistent with the scale Censys mapped (682 rotating hostnames across five naming templates, e.g. usps.xupq*.one, informed.deliwek*.shop), the operator likely used bulk/automated domain registration and a small pool of Tencent Cloud IPs to stand up disposable lookalike hostnames faster than they could be reported and taken down, a pattern typical of industrialized smishing-kit operations rather than a single hand-registered domain.
Bulk domain registration and disposable cloud hosting are hard to block pre-emptively at the registrar or registry level; the realistic control is downstream, using passive-DNS platforms (as Censys did here) to pivot from one reported lure hostname or IP to the full historical resolution set, exposing the entire rotating cluster instead of one domain at a time.
The operator built (or bought as a kit) a phishing platform that serves USPS's real production HTML, CSS, fonts, and images verbatim, reproduces a pixel-faithful fake Cloudflare human-verification gate, and wires a WebSocket-based backend for live keystroke capture, reflecting the underground phishing-kit-as-a-service tooling documented by Censys rather than a bespoke one-off build.
Kit development itself happens outside defender visibility, but brand owners can turn the kit's own cloning against it. Because this kit fired USPS's genuine analytics tag, USPS's marketing team could in principle detect anomalous conversion-pipeline traffic landing on its own dashboards from domains it does not own, and threat-intel teams can fingerprint kit-specific artifacts (asset paths, cookie names, banner hashes) to identify sibling deployments.
Victims received mass SMS text messages impersonating USPS or UPS, claiming a package required action and linking to a rotating lookalike hostname, a mass-targeting delivery method typically associated with SMS-blasting infrastructure and spoofed sender identities in commodity smishing campaigns.
Carrier-level SMS spam filtering plus consumer-facing anti-smishing guidance, USPS states that it does not send unsolicited text messages and that USPS text messages never include links, and easy reporting channels (forwarding suspicious texts to 7726) reduce both click-through and time-to-takedown.
Clicking the link presented a cloned Cloudflare 'Security Check' interstitial (with automatic language selection) before the payload loaded; per Censys, the gate's callback parameter was never actually validated, so its real function was filtering out casual scanners and crawlers rather than verifying humanity.
An attacker-controlled CAPTCHA gate cannot be neutralized directly by defenders, but automated threat-intel crawlers built to persist through such gates specifically for kit mapping and takedown purposes, as Censys did, keep this stage from providing durable cover.
The victim landed on a Vue single-page app built almost entirely from USPS's own genuine assets, complete with USPS's live Google Analytics tag, and as the victim typed payment-card details the page streamed each keystroke over an open WebSocket to the operator's backend before the form was ever submitted, per Censys's live capture of 279 WebSocket frames across seven sessions.
Because the clone reuses the brand's real static assets under a telltale path prefix and opens a live WebSocket before form submission, structural fingerprinting on that asset path or on pre-submission data exfiltration behavior gives defenders and browser-security tools a detection signal that survives hostname rotation, unlike relying on visual inspection of the page.
The backend ran a real-time BIN (bank identification number) lookup to validate and enrich each captured card, tracked every card a victim tried in a 'cardHistory' array to support a repeated decline-and-retry skim, and could flip an operator-controlled kill-switch ('isBlock') to redirect a flagged or suspicious session to the real usps.com, evading investigators and researchers.
Card issuers and payment networks can watch for real-time BIN-lookup-driven skimming velocity and repeated-decline patterns across newly seen card numbers, rather than assuming card theft only surfaces later via bulk breach dumps, closing part of the gap the kill-switch is designed to protect.
Captured payment-card data (number, name, expiry, CVV, BIN-enriched bank/country/scheme) was available to the operator for direct fraud or resale, while the same kit family was run in parallel against UPS customers under a linked infrastructure cluster sharing an internal 'us_post_ups' theme identifier, indicating the operator industrialized and reused the same toolset across brands rather than treating each campaign as disposable.
Once card data is captured, the surviving controls are issuer-side fraud monitoring and rapid card cancellation and reissuance for any consumer who reports interacting with a package-delivery smishing link, since the underlying data theft has already occurred by this stage; cross-brand infrastructure fingerprinting (shared cookie/theme strings, hosting ASN) also lets defenders take down the UPS sibling campaign using signals found on the USPS side, rather than treating the two as unrelated incidents.
Browse by what this case has in common with others in the library.
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
A Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Between 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging…
Lazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M…
A Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title…
In 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
DOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
Fraudsters posing as RBS fraud-team staff talked Hamilton Academical FC's sole authorised banking employee into moving nearly £1 million into…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Social Engineering Examples