Perfect Authentication of a Domain Nobody Faked

A mailbox at a large multi-site church organization received a signature request. It had the deep purple hero panel, the vendor wordmark, the white pen icon, a "REVIEW DOCUMENT" button and a nine-item footer running from do-not-share guidance through to the community forum. It was a faithful reproduction of a DocuSign notification.

It arrived from an ordinary consumer webmail account, sent directly through that provider's own outbound infrastructure. SPF passed. DKIM passed with a verified signature. DMARC passed.

Every one of those results is accurate, and none of them is about DocuSign. DMARC evaluates the domain in the From header, and the domain in the From header belonged to the webmail provider, which had indeed authorized its own account holder to send. Nothing in the header set ever claimed to be the e-signature vendor, so nothing in the header set could fail. RFC 7489 defines alignment between the From domain and an authenticated identifier, and that alignment held perfectly. The impersonation was not in a domain. It was in the pixels.

This is worth separating from a more familiar pattern. There were no per-hop discrepancies, no gateway that rewrote a body after signing, no softfail at a final relay. Nothing failed, which is precisely what makes the case instructive.

A Clone Assembled From the Vendor's Own Parts

The brand artwork was not copied or screenshotted. It was hotlinked. The wordmark and the white sign icon load from the vendor's genuine Akamai content delivery network, meaning a mail client rendering this message fetched the same image files from the same host that a real notification would. Those requests are indistinguishable from legitimate ones at the network layer.

The footer went further. Six distinct support and help URLs, the community forum, product pages, and the vendor's real report-abuse flow were all reproduced with working links. Every one scanned clean, because every one was real. A cautious recipient who clicked the report-abuse link would arrive on the vendor's own abuse-reporting page, which cannot tell them anything about the message they arrived from. The trust signals a careful user is trained to check were the parts the operator did not have to build. Nothing here indicates a breach at the vendor. No signing envelope was ever created, and none of the vendor's own sending infrastructure carried this message. Only its public assets were borrowed.

Two Template Builds in One Message

The two hotlinked image paths carry version numbers, and they do not match. The wordmark comes from build 2.62.0 and the sign icon from build 2.76.0, in the same message. A genuine notification renders from one template build, because it is generated once by one system.

Two vintages in one body means the kit was assembled from at least two separate real notifications harvested at different times, which is a durable structural tell requiring no reputation data to evaluate. MITRE ATT&CK tracks this kind of adopted identity as impersonation, and reassembly from authentic parts is what makes it convincing.

Thirty-Three Characters Where Thirty-Two Belong

Below the button sat an alternate signing block, the one a real notification includes for recipients who prefer not to click. It told the reader to go to the vendor's site, open the access-documents flow, and enter a security code. The code printed there ran to 33 hexadecimal characters.

The genuine product issues 32. Counting the string programmatically confirms it: one character too many, every character a valid hex digit. That code could never have been entered successfully by anybody, which tells you it was never intended to be. It was there because a real notification has one there.

It is the most useful tell in the message, because it is arithmetic rather than reputation. A length check against a known-format field needs no threat intelligence feed, no domain age, no sender history. It is also the strongest fingerprint the case produced.

The Only Live Control Left the Brand Behind

Every reassuring link in the message pointed at the impersonated vendor. The one link the message actually wanted clicked did not. The purple review button pointed at a public document on a third-party collaboration platform, a legitimate service whose free document-sharing feature was used as hosting. MITRE ATT&CK treats acquired web services this way: no infrastructure to register, no domain to age, and a host whose reputation is already good.

See Your Risk: Calculate how many threats your SEG is missing

By the time that link was scanned it was gone. The capture shows the platform's own message that the page is currently unavailable, and the verdict came back clean. So what the document contained is unknown, and this teardown will not guess at it. What is verified is the geometry: a message wearing one brand throughout, whose single actionable control pointed somewhere else entirely, at content that had already been withdrawn. That is the case for URL protection that re-evaluates a destination after delivery rather than once, at the gateway, against a page that was clean at the moment it was checked.

Addressed to Nobody in Particular

The To header read as undisclosed recipients, with the actual target in Bcc. There was no greeting, no name, and no personalization of any kind. This was a bulk send, and the effort visible in the body went entirely into the template rather than into the target.

That combination is the useful part. A message that reproduces a vendor's artwork this precisely, then addresses nobody, is spending its budget on rendering fidelity and none on relationship. The subject line, an invitation to bid on an upcoming construction project, was repeated verbatim as a line of body text in the slot where a genuine notification prints the envelope subject, another assembly artifact.

What Carried the Detection

None of the signals that flagged this were authentication results. The sender was a first-time sender at high risk with no prior correspondence in either direction. Themis, the IRONSCALES Adaptive AI analyst, scored the incident at 80 percent confidence and auto-resolved it as phishing, drawing on content-pattern analysis, sender analysis and community reputation, where the logged insight recorded high community confidence based on resolutions of similar incidents elsewhere. The same kit had been seen and settled in other tenants before it reached this one.

The 2024 Verizon Data Breach Investigations Report puts phishing in 15 percent of breaches and a human element in 68 percent of them, and both figures describe messages like this one, where the technical checks are honest and the deception is entirely presentational.

Where the Control Has to Sit

Three moves follow. Treat a full authentication pass on consumer webmail as a neutral fact rather than a positive one, because it certifies the account and says nothing about the brand in the body. Score brand-versus-destination mismatch directly, since a message dressed as one vendor whose only live control leaves that vendor's namespace is evaluable without any verdict on the destination. And check known-format fields for format, because a 33-character code in a 32-character field is a deterministic failure that no rendering fidelity can hide.

For recipients, the guidance in CISA phishing guidance and the behavior NIST describes both reduce to one habit here: reach the document through the vendor's site directly, never through the button. A clone can borrow every link in the footer. It cannot borrow the envelope.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

Every authentication check on this message was correct, and every one of them was answering a question nobody had asked. Check back tomorrow.