Following a USPS smishing kit through censys DNS data A live smishing campaign impersonating USPS uses the postal service's own production assets and Google Analytics tag. Censys passive DNS data revealed 682 lookalike hostnames tied to the operation, and a sibling campaign impersonating UPS on a separate backend. The same operator runs both campaigns, identified by structural signals such as cookie names and asset paths that persist despite rotating hostnames and IPs. Executive Summary - A live smishing campaign delivered by SMS impersonates United States Postal Service USPS package delivery. The lure is not a hand-built knockoff. The kit serves USPS’s own production HTML, CSS, fonts, and images verbatim from the phishing host, complete with USPS’s live Google Analytics tag firing against USPS’s real marketing infrastructure. - Underneath the deception the kit captures data in real time . It opens a WebSocket back to its origin and streams the victim’s card data keystroke-by-keystroke, runs a server-side BIN lookup on the card number, and pushes routing decisions retry, PIN prompt, OTP prompt, kill-switch back into the victim’s browser while they type. This was captured live, not inferred from source. - The lure arrives as a single hostname. Censys passive DNS turned that one host into the whole operation. A single seed IP resolved to over a hundred lookalike subdomains, and across the confirmed cluster Censys recorded 682 unique lookalike hostnames snapshot 2026-05-20 , most of which no longer answer in live DNS but remain in Censys’s historical record. - Pivoting on the kit’s HTTP banner hash carried the hunt from the USPS lure host onto a sibling running a second campaign from a Tencent prefix that impersonates UPS instead of USPS, on a Java/Spring Boot backend instead of the USPS kit’s Go backend. Both campaigns bake the operator’s own internal theme name, us post ups , directly into their cookies. Same operator, two brands, one kit family. - The durable detection signals are structural, not cosmetic: the /us post usps/ asset path, the theme verify us post ups cookie family, the valid <14digits <32hex token shape, and a banner hash that returns exactly the five UPS-themed not USPS hosts globally. Hostnames and IPs rotate weekly. These do not. It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful link to fix it. This one pointed at: https://usps.xupqnqz . one/uqjmw Believe it or not, xupqnqz . one is not USPS United States Postal Service . It is a six-character random string on a .one domain, prefixed with the comforting subdomain usps. That usps. label is the entire con. On a phone, with the real domain truncated in a narrow address bar, the leftmost thing the victim reads is “usps”. The kit operator is betting the rest never gets read. Tap the link and you do not land on a fake mailbox right away. You hit a “Security Check” page that is a pixel-faithful clone of Cloudflare’s “Verify you are human” interstitial: the orange shield, the rounded checkbox, the Performance & security by Cloudflare footer. It even ships a twelve-language translation table and picks your language from navigator.language , so the lure speaks English, Spanish, Chinese, Arabic, and eight others without the operator lifting a finger. This is the modern smishing pattern: wrap the scam in the most boring, most trusted interaction on the web. Nobody is suspicious of a Cloudflare check. We are all trained to click it and move on. That is exactly what the kit wants. For the purposes of this post, though, the interesting move is not the lure. It is what happens when you take that one hostname to Censys and start pulling on the thread. One Host, and What Censys Already Knew About It The lure hostname resolves to 43.157.174.200 https://platform.censys.io/hosts/43.157.174.200 , a Tencent Cloud machine in 43.157.128.0/18, ASN 132203 . A normal first step. The interesting step is the second one. Follow Along in Censys Censys does not just tell you what is running on 43.157.174.200 right now. It tells you every hostname it has ever seen resolve to that IP. Pull the host’s DNS view and the single SMS hostname explodes into roughly a hundred siblings, all variations on the same two themes: usps.xupq .one the SMS lure’s exact shape, with a rotating four-to-six character tail informed.deliwek .shop a nod to “Informed Delivery”, USPS’s real free mail-preview product That is the moment a single-link phishing report turns into an infrastructure hunt. The operator is not running one domain. They are running a domain factory , and one IP is hosting the whole catalog. Following the DNS This is the part of the investigation I want to dwell on, because it is the part that Censys makes almost unfairly easy and that you cannot reproduce with live DNS alone. Active DNS https://docs.censys.com/docs/platform-active-dns answers one question: what does this name resolve to right now . Smishing operators have read that memo. The lure hostname in your text message is meant to live for hours, maybe a day, then go dark. Resolve it next week and you get nothing. The infrastructure looks like it evaporated. It did not evaporate. It rotated. And Censys’s DNS resolutions data keeps the receipts. Querying Censys’s resolutions API for the seven IPs that ultimately make up this cluster returns 682 unique hostnames as of the 2026-05-20 snapshot. The shape distribution is the operator’s whole playbook on one page: Hostname shape | Count | What it impersonates | .life bare random apex | 334 | the operator’s preferred disposable landing domain | informed.deliwek .shop | 250 | USPS Informed Delivery | usps.xupq .one | 78 | the USPS SMS lure pattern | deliwek .shop bare | 17 | USPS delivery theme | xupq .one bare | 3 | apex of the lure pattern | Most of these names return nothing if you dig https://en.wikipedia.org/wiki/Dig command them today. They are spent. But they all sit in Censys’s history with first seen and last seen timestamps, which lets you reconstruct the rotation cadence and, more usefully, prove that a domain you just received in a fresh lure belongs to infrastructure that has been burning through names for weeks. The single host 43.157.174.200 alone accounts for 306 of those names. Two of its siblings carry another 197 and 202. A defender who only has the live hostname sees one disposable domain. A defender with Censys sees the disposable-domain generator and every name it has emitted. That is the difference, and it is the whole reason this investigation got interesting instead of dead-ending at a 404. What the Lure Actually Does Before chasing the rest of the infrastructure, it is worth understanding what is waiting at the end of the link, because the kit’s mechanics are genuinely a step above the average phishing page. Click the fake Cloudflare checkbox and the page makes a JSONP call to /eat?callback=jsonpCallback