It started with a text message at 11:47 PM.
Your USPS package could not be delivered. Please confirm address within 12 hours: usps-resolve-helpdesk[.]com/track
I don't have a USPS package coming. I know it's a scam. You know it's a scam. My mom would click it.
I usually delete these. This time I didn't. I was bored, I was wired on bad coffee, and I had a fresh Kali VM open.
I decided to click back.
Hour 0: Building The Cage
Rule #1 if you're going to poke scammers: never do it from your real life.
I spun up what I call my cage. It's not fancy:
- A Mullvad VPN exit in another state
- A Firefox profile that has never logged into anything real, running in a VM with no access to my files
- A burner email from SimpleLogin, a Google Voice number that forwards to nowhere
- Burp Suite open, recording everything
I clicked.
The site was a perfect clone of USPS. Good CSS, good logo, even the tracking animation. It asked for my address and a $1.45 redelivery fee. Classic.
I put in fake data. 123 Fuckyou Lane, Charlotte NC. The burner email. And a fake card number from Stripe's test card list: 4242 4242 4242 4242. Any payment form that accepts that without a Stripe test mode is not talking to Stripe. It's talking directly to a Telegram bot or a panel.
It accepted it. Of course it did.
Then it said "Payment Failed - Try Another Card." And it asked again.
That's the tell. They don't want $1.45. They want you to burn through 2-3 real cards trying. Each attempt is logged.
I checked the page source. The form action was posting to https:// usps-resolve-helpdesk[.]com/api/verify.php. Not USPS. Obvious. But inside that JS file was something less obvious:
A hardcoded Telegram bot token. In client-side JavaScript.
Amateur hour. Or they just don't care because they burn domains every 48 hours anyway.
I saved the token. I didn't touch the Telegram API yet — that's crossing a line from OSINT into unauthorized access. But I now had a thread to pull.
Hour 8: Day 1 - Who Are You?
I ran the domain.
Registered 2 days ago on Namecheap with privacy guard. Hosted on a cheap VPS in Moscow, ASN 203...something. Cloudflare in front of it.
But the phishing kit itself had left metadata. The favicon was /favicon.ico?v=usps2024 — same string I found in 11 other domains on URLScan.io. Same kit author.
I pivoted on URLScan. Found 3 other live clones:
- dhl-express-fix[.]com
- tolls-ezpass-pay[.]com
- chase-secure-alert[.]com
Same kit, same Telegram exfil structure, same bad opsec.
The scammer was running multiple campaigns off the same infrastructure. This wasn't a lone kid. This was a small operation.
I fed the burner email I used into HaveIBeenPwned, Dehashed, IntelX. Nothing. But the phone number I gave them? Within 4 hours I got a call.
Indian accent, call center noise in background. "Hello, this is USPS, we are calling about your package, your card did not work..."
I answered with a voice changer. "Oh thank god, yeah my card..."
He wanted me to read the card number over the phone. I gave him another fake one, slowly. He typed it. I heard him swear in Hindi when his own checker said invalid.
Then he got angry. "Madam, why you are wasting my time?"
That was the first time it got personal. He knew. He'd flagged me as a time-waster. Most people hang up here.
I apologized and said I was confused. He softened, went back to script. He asked for my real name to "verify the address."
I said "Lusynth." He paused. "What kind of name is that?"
Now it was really personal.
Hour 24: Day 2 - The Flip
I stopped playing victim and started playing bigger fish.
I sent a message to the burner number from another burner: "Hey bro, your USPS panel is showing token in source. You should fix. Also your Cloudflare is leaking origin IP via email headers when you send the smishing."
I was bluffing on the second part. But it's true 70% of the time.
He replied in 11 minutes: "who is this"
I said: "I buy logs. You have US logs? I saw your domain on Telegram. I want to buy."
This is how the ecosystem works. The kid who smishes is often not the guy who cashes out. He sells the "logs" — fullz — to someone else for $5-$15 each.
He sent me a Telegram handle. Not his personal — a business account with 2,300 subscribers. @usps_logs_live. Bio: "Fresh USPS/DHL/Chase - $8 per log - bulk - escrow"
Bingo. This was his storefront.
I joined with a sock puppet Telegram account. His channel had screenshots of "successful logs" — credit cards with last 4, bank names, victims' zips. One was from Charlotte. 28262. My zip code.
That one hit weird. Someone 10 minutes from me got hit by this exact guy and now their card is in his inventory.
I scraped the channel history with a Telegram export. 4 months of posts. I found patterns:
- He posted mostly 9am - 6pm IST. So India timezone.
- He always used the same Bitcoin address for escrow.
- He reused the same username on a blackhat forum from 2023:
desi_hustler_99.
I took that username and ran it through Sherlock, WhatsMyName. Found a GitHub. Found a now-deleted YouTube channel that taught "ethical hacking" with the same voice from the phone call.
He was 19. From his GitHub commits, learning Python from a course. His real name was in a commit email.
I'm not going to share it. That's doxxing and it's not the point. The point is, for 5 hours I had turned a random smishing text into a whole person.
And I felt sick.
Not because he was a mastermind. Because he wasn't. He was a kid who learned requests library 6 months ago and realized he could make more in a day scamming than his dad makes in a month. And he was good at it enough to hurt real people near me.
Hour 52: Day 3 - Shutting It Down Without Becoming Him
This is where most "I hacked the scammer" stories turn into revenge porn. They delete his files, they swat him, they leak his data. That's not justice, that's just becoming a different kind of criminal and getting your Medium account banned.
What actually hurts these operations is boring, unsexy, defensive work.
Here's what I did:
1. Killed the infrastructure. I reported the origin IP and domains to Cloudflare Abuse, Namecheap, and the host's abuse@ with full logs, headers, and the Telegram bot token. I also reported the Telegram bot to @botfather and the channel to Telegram abuse. Cloudflare dropped him in 6 hours. Namecheap suspended the domain in 12. His Telegram bot stopped responding by hour 60. His business is gone for that week.
2. Poisoned his logs. All those fake cards I fed him? I kept feeding them. 40 fake submissions over 72 hours from different fake personas via a simple Python script + Selenium. Every fake log he tries to sell now makes him look like a scammer to other scammers. His reputation on his own channel tanked. People started calling him rippper in comments.
3. Protected my own perimeter. I took that Charlotte victim zip as a warning. I rebuilt my home network trap. This is where my real work lives.
I don't use a normal router anymore. I use a little $26 travel router that runs OpenWrt — the GL Mango. I flashed it and put it between my modem and everything else. It runs Pi-hole to kill tracking and ad domains, and a tiny IDS that logs whenever an IoT device talks to a weird IP at 3am. It has saved me twice.
And I have a second box — a Pi Zero that runs a fully offline LLM. No cloud, no API keys. I use it to parse logs, summarize abuse reports, and draft the emails to hosting providers without ever sending victim data to OpenAI. When you do this kind of work, the last thing you want is to leak a victim's PII into someone else's training set.
What 72 Hours Actually Taught Me
Scammers aren't hackers. They're businessmen with bad code. Their opsec is terrible. They reuse passwords, they leave tokens in JS, they use the same BTC address. You don't need to be a 0-day god to beat them. You need to be patient and systematic.
The infrastructure is the product. Taking down one domain does nothing. Taking down his Telegram bot, his Cloudflare front, and poisoning his reputation does. Attack the business model, not the kid.
It will feel personal, and that's the trap. When you hear someone from your own city got hit, when the guy mocks your name, you want revenge. Revenge makes you sloppy and makes you cross lines that will get you in trouble. Document, report, sinkhole. Don't hack back.
Your family is the real attack surface. That USPS text wasn't aimed at me. It was aimed at my mom, your mom, anyone who is tired and expects a package. The best defense isn't your fancy EDR. It's a 10-minute conversation with your family: "The USPS will never text you for $1.45. If you're unsure, forward it to me."
I didn't save the world in 72 hours. I probably cost one 19-year-old about $400 in lost sales and a weekend of rebuilding his kit. He'll be back next week with a new domain.
But one domain gone means maybe 30 fewer people in 28262 get that text tonight. That's enough for me.
Don't try to be a hero. Be a speed bump.
Want the build notes for the defensive setup I used in this story?
I keep all the actual how-to stuff — the firmware, wiring, flash commands, blocklists, and offline AI setup — off Medium and in two guides I update constantly:
The $20 SOC: Build a Tiny Defensive Network Monitor — How I turned that GL.iNet Mango into a full Pi-hole + IDS + logging box that catches exactly this kind of IoT exfil and smishing infra. Parts list, flash steps, my configs: numbpilled.gumroad.com/l/20dollarsoxc
BUILD THE BLACKBOX: An Offline AI Field Terminal That Works When Nothing Else Does — The Pi Zero box that runs a local LLM with no internet, so you can analyze sketchy logs and write abuse reports without leaking anything to the cloud: numbpilled.gumroad.com/l/blackbox-offline-ai
