{ "Event": { "analysis": "1", "date": "2026-06-13", "extends_uuid": "", "info": "[Threat Intel] The Package That Never Shipped: Following a USPS Smishing Kit Through DNS Data", "protected": false, "publish_timestamp": "1782253803", "published": true, "threat_level_id": "3", "timestamp": "1782253802", "uuid": "5f1db648-9b34-47fd-aa68-47e63fa3de4b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#3d38fc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#db2044", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#5c59c9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Accounts - T1586.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"", "relationship_type": "" }, { "colour": "#82eae0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#b206a3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Accounts - T1586\"", "relationship_type": "" }, { "colour": "#c9dbdd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"", "relationship_type": "" }, { "colour": "#4a5d84", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#2e58ce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": "" }, { "colour": "#a0d02a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#b40719", "local": false, "name": "misp-galaxy:producer=\"censys\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#170059", "local": false, "name": "rectifyq:topic=\"mobile-attack\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781578876", "to_ids": false, "type": "link", "uuid": "d9833799-529c-454f-ac3a-6067d5b3f48c", "value": "https://censys.com/blog/following-a-usps-smishing-kit-through-censys-dns-data/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781578876", "to_ids": false, "type": "text", "uuid": "88828689-f89e-4f0b-a9ca-511600a208ca", "value": "A sophisticated smishing campaign impersonates United States Postal Service (USPS) package delivery notifications via SMS. The kit serves genuine USPS production HTML, CSS, fonts, and images verbatim, including live Google Analytics tags firing to USPS infrastructure. It captures victim card data in real-time through WebSocket connections, streaming keystrokes, performing server-side BIN lookups, and pushing routing decisions back to victim browsers. Starting from a single lure hostname, passive DNS analysis revealed 682 unique lookalike domains across seven Tencent Cloud hosts. A parallel UPS-themed campaign runs on the same infrastructure, with both variants sharing the internal theme name us_post_ups in cookies. The operation spans two distinct backends (GoFrame and Spring Boot) while maintaining identical real-time exfiltration mechanics and Caddy reverse proxy architecture." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781578876", "to_ids": false, "type": "text", "uuid": "da506de4-8ae9-4733-937e-a71a7c713e60", "value": "Name: The Package That Never Shipped: Following a USPS Smishing Kit Through DNS Data\nAuthor: AlienVault\nAdversary: \nTags: [\"tencent cloud\", \"real-time credential capture\", \"ups impersonation\", \"phishing kit\", \"websocket exfiltration\", \"smishing\", \"usps impersonation\", \"dns pivoting\", \"cve-2024-6387\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1583\", \"T1056.001\", \"T1036.005\", \"T1566.002\", \"T1598.003\", \"T1071\", \"T1586.002\", \"T1608.001\", \"T1583.001\", \"T1036\", \"T1185\", \"T1586\", \"T1608\", \"T1583.006\", \"T1041\", \"T1566\", \"T1027\", \"T1573\", \"T1056\", \"T1598\", \"T1071.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782233919", "to_ids": true, "type": "hostname", "uuid": "831c9e11-5d57-4f77-9250-59dd310c3b6a", "value": "usps.xupqnqz.one", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232885", "to_ids": true, "type": "sha256", "uuid": "452532da-0d99-4fa5-a97c-6b073a2046b1", "value": "4fe8bec780537aa223406965415c1f85e83eec1f4e2181cf82e2a7b7516026e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232886", "to_ids": true, "type": "sha256", "uuid": "94931e1c-c41e-4f57-b1e9-bdffeb7d200f", "value": "8e5546c83d764e1287b55cbe868a45344a6f0afa9782d798d03b2b7cfc53ec38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782233940", "to_ids": true, "type": "url", "uuid": "a2eb8699-81e9-4acb-a5cd-062ee7cea168", "value": "http://xupqrnn.one/us?__theme_site_ticket=", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782233962", "to_ids": true, "type": "url", "uuid": "e29e51ed-8a42-4738-a388-dfa6312c7987", "value": "https://usps.xupqnqz.one/uqjmw", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782233983", "to_ids": true, "type": "domain", "uuid": "6cb6209d-dba9-474e-8099-4e0e3cb5cd67", "value": "gwrpfjx.life", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234005", "to_ids": true, "type": "domain", "uuid": "70bfcc1d-644c-48e5-a0b1-027625ecc377", "value": "xupqnqz.one", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234026", "to_ids": true, "type": "domain", "uuid": "89a5a5ca-40bd-478f-aa70-e5c47dcbe210", "value": "xupqrnn.one", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234048", "to_ids": true, "type": "ip-dst", "uuid": "a9b77ab9-1888-48a2-9126-6e4cd97d127f", "value": "43.157.174.200", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234069", "to_ids": true, "type": "ip-dst", "uuid": "de5df19a-a944-4fa8-b56d-8bb4f965fe74", "value": "43.157.128.0/18", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234093", "to_ids": true, "type": "ip-dst", "uuid": "51031e1d-4ba6-4928-886b-2e1053f9393b", "value": "43.157.158.108", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234114", "to_ids": true, "type": "ip-dst", "uuid": "a58bb211-433d-4922-b365-0d7d68712932", "value": "43.157.151.131", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234135", "to_ids": true, "type": "ip-dst", "uuid": "c1b00632-b4b0-495b-b947-129b07feeded", "value": "43.157.148.168", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234156", "to_ids": true, "type": "ip-dst", "uuid": "571f6c74-ad78-4a35-beea-0a2312e0dfbe", "value": "43.173.100.171", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234177", "to_ids": true, "type": "ip-dst", "uuid": "e7714258-6582-4fb3-9123-ed7b89d0bddd", "value": "43.173.64.0/18", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234201", "to_ids": true, "type": "ip-dst", "uuid": "9f0b2ce2-0056-447a-92d6-c71181d07df3", "value": "43.173.104.156", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234222", "to_ids": true, "type": "ip-dst", "uuid": "b60dd4b0-3a02-4d0c-b669-32782f5f0c71", "value": "43.173.105.83", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ] } }