Every Link in This SoFi Clone Went to One Domain

Four mailboxes at a regional community bank received near-identical emails inside an eighteen minute window that evening. The subjects were lowercase and carried a timestamp instead of a reference number: "trade confirmation 19:14", then "trade confirmation 19:19", then "trade confirmation 19:32". Each body was a clone of a genuine SoFi notice announcing that a new trade confirmation document was available to view, carrying the brand's real corporate mailing address, its real published support number, and its real legal footer text.

The link scanner returned a malicious verdict on the primary call to action. That alone closed the case. What made the message worth writing up is what the scanner found on everything else.

Every Link Pointed at One Attacker Subdomain

A branded financial notification like this one is mostly links. There is the button the attacker wants clicked, and then there is everything around it: the regulator memberships, the securities investor protection notice, the legal and disclosure page, the two app store download badges, "Chat with us", and "Contact us". In a real notice those point outward to half a dozen unrelated organizations.

In this message they did not point outward at all. After stripping the Microsoft Safe Links wrapper, every one of them resolved to the same host, a hex-labelled subdomain of brossardcricket[.]org, each carrying its own long unique tracking token so the operator could tell which link a recipient had touched. The primary "View documents" call to action went there. So did the regulator links, the legal disclosure, the app download badges, and the live chat link. Not one of them went to sofi[.]com.

Decorative Links Are a Detection Surface

The footer links in a corporate email are not there to be used. They are there to be seen. A regulator membership badge and a securities protection notice signal a supervised financial institution, and an app store badge signals scale. They perform trust, and because nobody clicks them, nobody inspects them either. Analysts triage the call to action, gateways score it, and users hover over it.

That asymmetry is exactly why the furniture is worth checking. An attacker cloning a template with a tool that rewrites links in bulk does not stop to preserve the honest ones, because preserving them buys nothing and costs effort. The polish gradient runs backwards from where defenders look.

There is a cheap machine check hiding in that. Count the distinct registrable domains behind all of the links in a branded notification, then compare that set against the brand the email claims to be. A genuine trade confirmation has a heterogeneous link profile spanning the broker, two regulators, two app stores, and a help centre. A cloned one collapses to a single host with a different token per link. Homogeneity where you expect variety is the signal, and it needs no reputation data at all. Malicious URL and payload inspection that only ever evaluates the primary destination is inspecting the one link the attacker cared about most.

Amazon SES Carried It and Authentication Agreed

The sender was info@koutom[.]com, a domain registered weeks before the send through a mainstream registrar with WHOIS privacy applied. A throwaway, stood up for this campaign and nothing else.

Delivery ran through Amazon Simple Email Service out of a us-west-1 sending host. DKIM passed with signatures for both the attacker domain and the service, DMARC passed with the header From aligned, and composite authentication scored at the maximum. Every one of those results is correct, and none of them are relevant. The attacker did control koutom[.]com. The claim authentication never evaluated is the one printed across the body, which was that the message came from a consumer finance brand the bank had no relationship with in that channel.

Renting reputable sending infrastructure is now a line item rather than a technical achievement, which is why acquiring web services sits alongside acquiring domains in MITRE ATT&CK as ordinary campaign setup.

See Your Risk: Calculate how many threats your SEG is missing

The Display Name Collided With the Bank's Own Alias

The header carried a second impersonation stacked underneath the first. The display name was a single generic uppercase word announcing the message as an automated notification. Sender analysis flagged it as a similar display name impersonation, because the bank runs an internal system alias with a closely matching name that sends genuine automated banking notices to staff.

That detail is sharper than generic brand spoofing. In a phone preview pane the display name is frequently all a recipient sees, and this one had been shaped to read as internal plumbing while the body told a story about an external brokerage document. Reconciling those two impressions means noticing that a familiar internal-looking sender is delivering third-party financial paperwork, and the 2024 Verizon Data Breach Investigations Report puts the median time to click a phishing link at 21 seconds. That is not enough time.

The SPF Failure Was Not the Signal

The headers do show an SPF failure, and it is a trap. It appears at a hop belonging to the bank itself, a content disarm and sanitization relay that inspected the message and re-sent it internally, marking it sanitized on the way through. Rewriting mail in transit breaks alignment downstream as a matter of course, and SPF passed where it mattered, at the originating service hop. Reading that internal failure as spoofing evidence would be the right verdict for the wrong reason, and the same logic would false-flag every legitimate message crossing that relay. Authentication results, as NIST and CISA phishing guidance both frame it, start a content and context review rather than replace it.

One Seam in the Clone

The clone was good, and it had one visible flaw. The greeting ran the recipient's first and last name together with no space between them, a merge field populated without its separator. The recipient was the bank's chief human resources officer; the other three mailboxes belonged to staff in adjacent back-office functions. Nobody in that group has a professional reason to receive a brokerage trade confirmation at work, and that context layer is the one no amount of template fidelity can fake.

How the Case Actually Closed

This one came in as a community report rather than an automated block. Themis, the IRONSCALES Adaptive AI analyst, scored it at 50 percent with a vip-recipient label, and the hard evidence came from link analysis: a malicious verdict on the call to action with captured screenshots of the landing paths, reinforced by community resolution history describing highly confident phishing on closely similar incidents. An analyst approved the verdict manually and all four mailboxes were quarantined, including the two earlier sends. The gap between the first send and the resolution is the window this attack lives in, and shrinking it is what credential harvesting protection is for.

What To Take From This Case

Pull the full link inventory of any suspicious branded notification, not just the button. Ask how many organizations the email claims to be connected to and how many hosts it actually reaches. When the answer is one, the whole message is a costume, and you have that answer before touching reputation feeds, sandboxes, or WHOIS. Clean authentication and reputable sending infrastructure are table stakes for an attacker now, so the residue worth hunting is in the parts of the template nobody was ever supposed to read.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

Attackers polish the link you were going to check. Check the ones you were not. Back tomorrow with the next teardown.