Brand Impersonation Evidence: USPS

Lookalike domains are impersonating USPS

This is a public evidence page from Scam Detective’s published research. The real USPS operates at usps.com. The 2 domains below impersonate it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

Lookalike domains found

Critical

Overall risk level

Independent corroborating sources

October 17, 2026

Case verified

Confirmed lookalike domains

Critical riskSmishing lure domain — fake USPS redelivery site

usps-redelivery.com

Registration profileRotating burner domains registered in bulk ahead of each text wave — the operation runs automated mass-texting infrastructure and replaces domains as they are flagged

First seen2025–2026 smishing surge — among the lure-domain names documented in our investigation of the campaign

Evidence

The text claims a package is on hold for an incomplete address and demands a small redelivery fee (as little as $0.03) at a link — USPS never charges redelivery fees by text; the real redelivery service is free.
The landing page closely mimics USPS.com — the blue-and-gray color scheme, the eagle logo, the layout — then asks for your address, name, phone number, and card details.
Real USPS links always go to usps.com and nothing else — any domain containing “usps” that isn't exactly usps.com is a lookalike.
The tracking numbers in the scam texts are random strings that don't follow USPS's 22-digit format — verifiable directly at USPS.com.
The texts come from random 10-digit numbers, not the verifiable short codes USPS actually sends from.

High riskSmishing lure domain — “package hold” variant

usps-package-hold.com

Registration profileSame bulk-registered rotation — interchangeable lure names for the same automated text pipeline

First seen2025–2026 smishing surge, alongside the redelivery variant

Evidence

Second documented lure-domain name of the same campaign — the “package hold” framing of the same on-hold story, with the same fee demand.
Same USPS.com page clone and the same personal-and-card-detail harvest behind the link.
The scammers operate from outside the US using spoofed phone numbers and rotating domains to reach millions of phones.

Pattern watchlist — not yet independently confirmed

usps-package-hold.net — Alternate extension of the same lure name — the operation swaps TLDs (.com ↔ .net) as domains are flagged.

Red flags in this impersonation

01USPS does not text you about package problems unsolicited — real delivery updates come through the official tracking system you opt into at USPS.com or via Informed Delivery.

02The link domain is not usps.com — this is the whole check; every other signal is secondary to it.

03A fee is required for redelivery — the real USPS redelivery service is free and arranged through your account or your local post office.

04The tracking number doesn't match USPS's format (22 digits, specific prefixes like 9400, 9205, 9370).

05The text comes from a random 10-digit number instead of a verifiable USPS short code.

06The same wave impersonates FedEx, UPS, and other carriers — treat every unsolicited package text the same way.

Who corroborates this evidence

USPS's own public warnings

USPS itself has issued multiple public warnings about the surge in fake text messages impersonating the Postal Service.

Federal Communications Commission

The FCC has flagged postal-service smishing among the fastest-growing text-fraud categories, with smishing complaints surging by more than 500% between 2022 and 2025.

Scam Detective's published investigation

Our investigation of the campaign mapped the automated text pipeline, the USPS.com page clone, and the lure-domain naming pattern across thousands of domains and millions of messages.

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free USPS impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.