The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data - Censys
Join the Censys ARC Webcast on July 8 (live Q&A for attendees only)
Register Now
Platform
Platform
Description<br>The one place to understand and act on everything on the Internet.
Platform Overview
Internet Map
Integrations
AI at Censys
Description<br>Purpose-built capabilities that power security operations and exposure management.
Censys Search
Censys Core
Adversary Investigation
Attack Surface Management
Critical Infrastructure Monitoring
Featured Post
Censys Powers SOC Modernization with Real-Time Internet Context and Risk Scoring
Read More
Solutions
Solutions
Description<br>Use-case guides for modern security teams: investigate, prioritize, respond, and reduce risk.
SOC Modernization
Adversary Intelligence & Threat Hunting
External Exposure Management
Critical Infrastructure Resilience
Description<br>Industries bring unique exposures and adversaries.<br>Learn how Censys can help.
Cybersecurity
Energy & Utilities
Financial Services
Government
Healthcare
Featured Post
The Ultimate Guide to Detection Engineering with Censys
Read More
Censys ARC Research
Censys ARC Research
Description<br>Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Censys ARC
Latest Research
Rapid Response Advisories
Threat Intelligence
Featured Post
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Read More
Resources
Resources
Description<br>Explore Censys updates on products and partnerships, plus thought leadership on Internet risk trends.
Blog
Resource Hub
Integrations
Case Studies
Events
Webinars
Pricing
Developers
Documentation
Community
Compliance
Glossary
Company
Company
Description<br>Learn more about the Censys mission and the talented team behind it.
About Us
Leadership
Our Customers
Partners
Careers
Censys Raises $70 Million in Strategic Funding to Expand Its Internet Intelligence Platform
Read More
Request Demo
Get Started Now
Login
Platform
Platform
Description<br>The one place to understand and act on everything on the Internet.
Platform Overview
Internet Map
Integrations
AI at Censys
Description<br>Purpose-built capabilities that power security operations and exposure management.
Censys Search
Censys Core
Adversary Investigation
Attack Surface Management
Critical Infrastructure Monitoring
Featured Post
Censys Powers SOC Modernization with Real-Time Internet Context and Risk Scoring
Read More
Solutions
Solutions
Description<br>Use-case guides for modern security teams: investigate, prioritize, respond, and reduce risk.
SOC Modernization
Adversary Intelligence & Threat Hunting
External Exposure Management
Critical Infrastructure Resilience
Description<br>Industries bring unique exposures and adversaries.<br>Learn how Censys can help.
Cybersecurity
Energy & Utilities
Financial Services
Government
Healthcare
Featured Post
The Ultimate Guide to Detection Engineering with Censys
Read More
Censys ARC Research
Censys ARC Research
Description<br>Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Censys ARC
Latest Research
Rapid Response Advisories
Threat Intelligence
Featured Post
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Read More
Resources
Resources
Description<br>Explore Censys updates on products and partnerships, plus thought leadership on Internet risk trends.
Blog
Resource Hub
Integrations
Case Studies
Events
Webinars
Pricing
Developers
Documentation
Community
Compliance
Glossary
Company
Company
Description<br>Learn more about the Censys mission and the talented team behind it.
About Us
Leadership
Our Customers
Partners
Careers
Censys Raises $70 Million in Strategic Funding to Expand Its Internet Intelligence Platform
Read More
Request Demo
Get Started Now
Login
Resources1 › Blog2
BLOG ◆<br>◆ --><br>JUN 12, 2026
The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data
Research, Threat Intelligence
Executive Summary
A live smishing campaign delivered by SMS impersonates United States Postal Service (USPS) package delivery. The lure is not a hand-built knockoff. The kit serves USPS’s own production HTML, CSS, fonts, and images verbatim from the phishing host, complete with USPS’s live Google Analytics tag firing against USPS’s real marketing infrastructure.
Underneath the deception the kit captures data in real time . It opens a WebSocket back to its origin and streams the victim’s card data keystroke-by-keystroke, runs a server-side BIN lookup on the card number, and pushes routing decisions (retry, PIN prompt, OTP prompt, kill-switch) back into the victim’s browser while they type. This was captured live, not...