A Capital I in 'Blue' and Two Blocks of Invisible Text

A corporate employee at an industrial IoT firm received a message that looked like it came from a health insurer. The sender display name read BIueCross Ins Status.

Read that first word character by character. The second letter of BIue is not a lowercase l. It is a capital I.

In the sans-serif fonts that mail clients use by default, a capital I and a lowercase l are the same vertical stroke. To a person glancing at a sender column, the name says BlueCross. To a string comparison or a display-name allow-list, it is a different word entirely. That one substituted character carried the whole impersonation. Everything else in the message was either honestly authenticated or deliberately hidden from view.

One Character Does the Impersonation

Homoglyph abuse is usually discussed as a domain problem, the Cyrillic lookalike or the digit swapped for a letter in a registered name. Here the substitution sat somewhere cheaper and less examined: the friendly name in the From header.

That field is free text. SPF, DKIM, and DMARC evaluate envelope and header domains; none of them touches the display name, and most mail clients show it in preference to the address behind it. An attacker who wants to be seen as a brand can simply type the brand, and a filter watching for exact brand strings is walked past by one lookalike character.

The rest of the presentation was built to match. The subject announced an important update about the recipient's coverage for the coming plan year. The body reproduced the insurer's real blue-on-white palette and plan-selection layout, then made an offer: a branded Medicare kit, with a stated total allotment of 800 kits and a request period that closed Tomorrow. The call to action read View Your Kit & Plan Options.

That deadline carries no date, which is what a template reused across many sends looks like. The scarcity number does the same work, specific enough to feel administrative and unverifiable by design.

Two Blocks of Text the Recipient Never Saw

The interesting part of this message was never on screen.

The HTML carried two multi-paragraph blocks of prose that did not render. One sat inside a container set to display:none. The other used roughly 8-pixel type in a near-white color on a near-white background, technically present, visually gone. Both held ordinary, grammatical, entirely human-readable English about organizing a community wellness gathering. Nothing about insurance, nothing about the lure, nothing hostile.

That is precisely the function. This is content stuffing, distinct from the more familiar trick of padding a message to manipulate the inbox preview line; these blocks are too long and sit too deep in the body to be preview bait. What they change is the ratio. A text-analysis pass over this message body sees a large volume of benign, well formed natural language wrapped around a short branded pitch, and any classifier weighing suspicious language against innocuous language is being handed a thumb on the scale. The recipient, meanwhile, sees only the pitch.

Defending against that means reading structure rather than words, the layer our Adaptive AI is pointed at. Deliberately unreadable text is itself the signal, regardless of how pleasant it happens to be.

See Your Risk: Calculate how many threats your SEG is missing

A Clean Authentication Result for the Wrong Domain

The message sent from seedvan[.]com. SPF passed for that domain from 188[.]119[.]122[.]163. DKIM passed with a valid signature, d=seedvan[.]com, selector v2512. DMARC passed. Composite authentication returned compauth=pass reason=100.

It is easy to read that row of green results as the dangerous pattern where an attacker achieves a full pass under an enforced policy belonging to the impersonated brand. This is the opposite case. Every check resolved against the sending domain, which publishes a DMARC policy of p=none. Alignment held because the attacker controlled both sides of it, and the policy asked receivers to enforce nothing. Under RFC 7489, a pass against an unenforced policy says only that a domain sent its own mail.

Nothing in that evaluation involved the insurer. No BlueCross domain appeared anywhere in the headers; the message never claimed to be From one, and never needed to.

The domain itself gave a defender very little. It was registered in February 2023, roughly eighteen months before this message arrived, through a mass-market registrar and pointed at Cloudflare nameservers. Not a fresh registration, not a typosquat, no brand reference in the string at all. Reputation systems had no reason to object.

The Landing Page Was the Sending Domain

The call to action resolved to hxxp://www[.]seedvan[.]com/rb2k6. Same domain as the sender. No redirect chain, no link shortener, no compromised third-party host, no vendor rewriter to unwrap.

Simplicity is a choice here rather than an oversight. Multi-hop redirection exists to launder a reputation the attacker already has, and with an aged domain and working authentication there was nothing to launder. Note also the plain hxxp scheme: no certificate, no lock icon, no attempt to earn one.

Mapping to MITRE ATT&CK

• T1566.002 Phishing: Spearphishing Link covers delivery, with the payload carried as a single branded call to action rather than an attachment.
• T1656 Impersonation covers the homoglyph display name and the reproduced brand styling, which together do all of the persuasion.
• The hidden filler blocks function as a defense-evasion sub-pattern layered on that delivery, degrading automated content analysis without altering what the recipient reads.

Indicators of Compromise

What Actually Flagged It

Automation did not close this one on its own. Themis, our Adaptive AI analyst, scored the message at 52 percent confidence with no hard label, working from heuristic phishing indicators and community reputation signals rather than anything decisive. That is the middle of the range, exactly where a fully authenticated message on an aged domain with no known-bad links tends to land.

A human SOC analyst then reviewed the case and classified it as malicious, and that manual approval is the verification of record here. Nothing about this was blocked ahead of delivery. The message was seen, then judged.

The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and phishing in 15 percent of them, and clocks the median time to click a phishing link at 21 seconds. A middling automated score plus a fast human read is a far better outcome than a confident automated verdict in either direction.

The Takeaway

Three things generalize from this message.

Compare display names at the character level, not the word level. Equality tests miss every homoglyph, and the display name is the one field an attacker fills in freely with no authentication consequence.

Treat invisible text as an anomaly on its own terms. Zero-height, zero-opacity, and light-on-light content blocks have almost no legitimate use in inbound business mail, and their semantic content is beside the point; the volume of hidden text is the finding.

Keep DMARC results in their lane. A pass proves a domain sent its own mail. Where the domain publishes p=none, it barely proves that much. CISA's phishing guidance and NIST's definition of phishing are useful anchors for teams working out where authentication ends and judgment has to begin.