ROCHESTER, N.Y. – The Grinch is busy this Christmas season. There are countless bad guys who are out to ruin your holiday. The USPS text message scam is one of the more pervasive ones. I got two just last week. So, I started doing a bit of research. I chatted with the experts from CNET about their consumer survey asking folks about the holiday scam that concerns them the most.

“What survey respondents told us is actually a scam we see a lot this time of year, and that is non-delivery scams,” said Danni Santana, a CNET personal finance editor.

There’s a good reason this scam worries consumers. Think about all the packages that were likely delivered to your home during the past couple of weeks. So, during the holidays, that scam is effective.

“You get a text message or an email saying that your package couldn’t be delivered, something’s wrong with your order,” said Santana. “And there’s usually a link or a QR code that you have to click on or scan so you can rectify the problem.”

But there is no problem. The problem only occurs if you click on that link. Scammers are either trying to fool you into providing sensitive information or they’ll unleash malware or spyware on your device.

I got two delivery scam text messages this week. They had two different links but were similar in two important ways. In both links, the scammers used USPS in the address to try to fool you and the domain names of both ends in .top.

A recent study by Interisle indicated the .top suffix was number two in the world for the number of malicious phishing websites, second only to the very common .com

The .top domain .dot top is owned by the Chinese company Jiangsu Bangning Science and Technology. In July it received this letter from ICANN, the Internet Corporation for Assigned Names and Numbers, telling the company it had received so many reports of malicious conduct from parties that bought domain names from them ICANN was going to yank its license to sell domains unless the company started shutting down bad actors.

The United States postal service will never send you an unsolicited text message. It will only text you if you sign up for the free service to track your package, and those messages will never have a link or QR code.