The Brand Name Was in the Path, Not the Domain

Four mailboxes at an industrial equipment manufacturer received the same message on the same morning, one of them a senior developer in the IT group. The subject line was terse to the point of being sloppy: a bracketed external-sender tag, then "Pls sign: Agreement renewal". The sender's display name, vdDocx_secure, gestured at a document-signing service without naming one. There was no attachment. The entire attack hung on a single button labeled "View Document".

Follow that button and you reach the part worth studying. On hover, the link resolved to a Microsoft protection hostname. Peel back two layers of rewriting and the real destination was a Canadian film production site with Tesla[.]com bolted onto the end of its URL path. Not a subdomain. Not the host. A directory name.

An agreement renewal from a domain with a spotless record

The mail was relayed through a major cloud sending service's European region on behalf of a sending domain registered more than two decades earlier. Every authentication check a gateway leans on came back green. SPF passed against the relay. DKIM verified twice, once for the sending domain and once for the relay operator. Composite authentication resolved to pass with a strong reason code.

The one soft spot was DMARC, which returned a best-guess pass rather than a policy-backed one, because the sending domain publishes no DMARC record at all. Under RFC 7489 a receiver with no policy to consult falls back to inference, and the inference here was favorable. A domain that old with mail that clean does not read as hostile. It reads as a vendor.

That is the point. Nothing in the envelope indicated a purpose-built attack domain, because there was not one. A long-standing legitimate domain that has been compromised or otherwise abused inherits every clean verdict it ever earned, which puts this squarely in the territory MITRE ATT&CK tracks as compromised web-service infrastructure, T1584.006.

Two security wrappers, one laundered link

Here is where the case gets genuinely awkward for the standard user-training advice.

By the time this message sat in a mailbox, the href behind "View Document" had been rewritten twice, and neither rewrite was the attacker's work. The recipient tenant's own inbound link protection had wrapped the URL in a Microsoft safe-links domain. Upstream of that, a secure-web proxy branded by one security vendor and operated on another's infrastructure had already rewritten the target into its own scanning domain, carrying the true destination as a base64-encoded parameter.

This is what those controls are built to do, and the intent is sound. But consider what it does to the human staring at the status bar. The visible hostname belongs to Microsoft. The layer beneath it belongs to a well-known security vendor. A cautious employee who has been trained to hover before clicking performs the check correctly, sees two trusted security domains, and is reassured by defensive infrastructure into clicking an attacker's link. The 2024 Verizon Data Breach Investigations Report puts the median time to click a phishing link at 21 seconds, and the median time to then submit data at 28 seconds. There is no room in that window for a decode-and-inspect exercise.

See Your Risk: Calculate how many threats your SEG is missing

A famous domain that was only ever a folder

Decode the wrapper and the chain terminated at hxxps://originfilms[.]ca/73ee91, which then redirected to hxxps://originfilms[.]ca/73ee91/Tesla[.]com.

Read that slowly, because the deception is entirely structural. In a URL, the authority ends at the first single slash. Everything after it is path. So the host here is a Canadian film production domain that had been online for roughly seven years, and Tesla[.]com is a folder name sitting two levels deep inside it. It resolves nothing. It requests nothing from the carmaker. It exists to be read by a person, not parsed by a browser.

The trick works on how humans scan text and how clients truncate it. Eyes hunt for a recognizable brand token and stop there. Narrow windows and mobile clients clip long URLs, and a status-bar preview often shows the tail rather than the head. Put the trusted name at the end of the path and you get the visual payoff of a lookalike domain without paying for one, without tripping a newly-registered-domain heuristic, and without typosquatting a registrar could dispute. MITRE ATT&CK classes this kind of visual masquerade as impersonation, T1656, delivered here through a spearphishing link, T1566.002 that depends wholly on user execution of that link, T1204.001.

Worth stating plainly: the destination page never rendered cleanly for our analysts. Automated captures came back blank and scanner verdicts disagreed. We will not invent what was on it. The verified artifact is the raw href, and it is damning enough.

The template they forgot to fill in

The body of the message was not designed for this campaign. It was a stolen marketing template belonging to a European apparel retailer, reused wholesale and never properly populated. Two merge placeholders, {mename} and {Domainrealname}, rendered as literal curly-brace tokens in the delivered mail, because whatever tooling sent this was not the bulk platform the template was written for. A real employee address from the original retailer remained hardcoded in a static footer field, along with copyright text bearing a year that had not happened yet.

Those artifacts are the cheapest tell in the case and they cost nothing to avoid. They also explain the operating model: harvest a template that already renders beautifully in Outlook, graft one button onto it, ship it from borrowed infrastructure. Nobody proofread it.

Where this one actually broke down

No human triaged this. Automated detection flagged the message, the platform resolved it as phishing on its own, and all four copies were reverted out of their mailboxes with no administrator action recorded. Content and behavior carried the verdict, because the headers offered nothing to reject and the URL offered a Microsoft hostname to anyone checking casually.

That is the capability gap. Authentication was clean, both rewriting layers worked as designed, and the message still needed something that reads intent rather than reputation. IRONSCALES Adaptive AI decodes and judges every URL rather than trusting the wrapper it arrives in, which is the practical requirement for malicious URL and payload defense once attackers hide behind your own vendors' domains. For teams on native controls alone, that residue is what Microsoft 365 augmentation exists to catch, a layering argument CISA's phishing guidance makes as well.

The takeaway is uncomfortable but simple. "Hover before you click" is dead advice when two security products rewrite the hostname before a user sees it, and the brand a user is hunting for can be dropped anywhere in the path for free. Teach the structure instead: the only part of a URL that decides where you go is the text between the scheme and the first single slash. Everything after that is text the attacker chose. Stop asking users to be the parser.

See you next time

Attack of the Day is our daily teardown of the real phishing our SOC intercepts. The details are anonymized, the tradecraft is not. Come back tomorrow for the next one.

Indicators of Compromise

MITRE ATT&CK Mapping