A recent discovery has found an alarming rate of traffic to domains associated with phishing campaigns targeting the United States Postal Service (USPS), revealing that traffic to fraudulent domains often rivals or surpasses that of the legitimate USPS website, most notably during the holiday season. Initiated by an investigation into suspicious SMS messages, researchers uncovered a significant number of “combosquatting” domains designed to mimic the official USPS site, deceiving users into downloading malware, sharing sensitive information, or mostly making payments to fraudulent entities for what’s often advertised as a “redelivery” fee. The findings from October 2023 to February 2024 indicate a sophisticated and wide-reaching effort by cybercriminals to exploit the USPS brand, with malicious traffic peaking during the November to December holiday season. This underscores the broader risk of combosquatting campaigns that potentially target multiple brands beyond USPS. The fake sites used in these campaigns leveraged convincing replicas of USPS’s website and package tracking system, with one of the malicious domains having attracted nearly half a million queries, and multiple others surpassing 150,000. CTIX analysts encourage consumers to exercise caution and skepticism towards unsolicited communications about package shipments. To avoid falling victim to these phishing attempts, it’s recommended to directly access the official USPS website for any parcel tracking needs rather than clicking on links provided in messages, thereby safeguarding personal and financial information from cybercriminal activities. The USPS also has a page on their website related to these phishing campaigns for how to report potential fraud and prevent being scammed. A link can be found below.