The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data

A live smishing campaign impersonating USPS (and a sibling UPS campaign) delivers a sophisticated phishing kit that serves genuine USPS assets, streams victims' card data keystroke-by-keystroke via WebSocket, performs server-side BIN lookups and operator-driven routing, and is backed by a domain factory observed in Censys (hundreds of disposable lookalike hostnames); durable IOCs include specific cluster IPs in Tencent prefixes, hostname-generation patterns (xupq*, deliwek*), asset-path prefixes (/us_post_usps/), cookie names (theme_*_verify_us_post_ups, gfsessionid), and two banner hashes/JA4T fingerprints recommended for monitoring.