The RFQ With No Sender and a Hijacked Reply Path

The message announced itself as a request for quote. A buyer claimed an urgent need for metal stock, asked for pricing, and dropped the note into four mailboxes at a US industrial automation and manufacturing equipment supplier at the same time. Nothing was attached. No link waited to be clicked. The entire payload was two sentences of plaintext and a signature. What made it an attack was the header, and specifically what the header was missing.

The visible From line showed a sender name, Oleksii Som, and then nothing where the email address belongs. The address field was empty. A legitimate mail client fills that space with a routable address; this one had a display name floating above a blank. The Message-ID, the unique fingerprint every mail server stamps on an outbound message, was built around the literal token no[.]domain, a placeholder string that no real mail system would ever generate. And the Reply-To pointed somewhere the sending path had no relationship with at all.

Three broken pieces of metadata, assembled on purpose.

A From Header With No Address

The From header is the line a recipient reads to decide who is talking to them. Here it had been hollowed out. The display name, a fabricated persona, was present to give the eye something human to latch onto. The address behind it, the part that actually identifies a mailbox, was blank. That is not a rendering glitch or a truncated forward. It is a deliberate construction that hands a reader a name and no way to see that it resolves to nothing.

Paired with it was the malformed Message-ID. Genuine mail infrastructure derives that identifier from the sending host's real domain. This one used no[.]domain, a hardcoded stand-in that betrays a message hand-assembled outside a normal mail pipeline. On their own, an empty address or an odd Message-ID might be written off as a misconfigured sender. Together, they describe a message that was never meant to survive scrutiny, only to be answered quickly.

The Authentication Trail That Led Nowhere

There was almost nothing for a cryptographic check to grab. DomainKeys Identified Mail (DKIM) was absent; the message carried no signature. Domain-based Message Authentication, Reporting and Conformance (DMARC) was absent too, so there was no alignment policy to enforce and nothing to fail against. The one green light was Sender Policy Framework (SPF), and it passed only for the Return-Path domain, calesmet[.]com, a long-registered Spanish business domain routed through a generic hosting relay, mx3.compsaonline[.]com, at 82[.]223[.]32[.]41.

That SPF pass is a trap for anyone reading auth results too literally. It vouches for the envelope path, the bounce address the relay used, and says nothing about the empty From identity a human actually sees, and nothing about where a reply would travel. The rules of the road here are set out in the DMARC specification, RFC 7489, which is exactly the alignment layer this message never published. Microsoft's own filters were not fully fooled by the lone green light; the message drew a spam confidence level of 5 and was flagged as spam by antispam heuristics. But a busy buyer skimming an urgent quote request does not read spam confidence levels. They read the name and the ask.

The Reply-To Was the Whole Point

With no link to click and no file to open, the attacker needed the victim to do the work, and the mechanism was the reply. The Reply-To header diverted to clientes.3msl@primergrupo[.]com, an address on a long-established, unrelated organization's domain that had no connection to the Return-Path sender, the empty From identity, or the recipient. It was not a lookalike of any brand. It was simply a drop box, positioned so that the instant anyone hit reply to quote a price or ask a clarifying question, their message would sail past the apparent sender and land in a mailbox the attacker could read.

This is the quiet engine of a whole class of business email compromise: no malware, no credential page, just a believable pretext and a hijacked reply path. The RFQ framing was chosen because it demands a response. A quote request is revenue walking in the door, not something a supplier ignores. The body leaned on that instinct with generic urgency, "top urgent," and a tell a careful reader might catch, the misspelled product category "Matels" instead of Metals, alongside a signature phone number whose country code did not match the sending geography.

Why Behavior Caught What Signatures Could Not

A gateway that scores mail on payloads had nothing to score. No attachment to detonate, no URL to reputation-check, no failing DKIM signature to point at. The only evidence was structural and behavioral, and that is precisely where Themis, the Adaptive AI analyst on the IRONSCALES platform, does its work. An empty From address, a Message-ID minted from a placeholder domain, a Reply-To that points away from the sender, a first-contact RFQ with mismatched geography and clumsy spelling: individually weak, collectively a clear picture of a reply-redirect attempt. Reading the relationship between those signals, rather than waiting for a payload to trip a rule, is the difference between catching this and forwarding it to accounts payable.

Mapping to MITRE ATT&CK

The tradecraft sits under T1566 Phishing in its link-free, attachment-free reply-bait form, where the message itself is the whole lure. The attacker-controlled reply channel, a mailbox staged purely to capture diverted responses, maps to T1585.002 Establish Accounts: Email Accounts.

Indicators of Compromise

The Takeaway

Authentication results are a floor, not a verdict. A single SPF pass on an envelope domain told the truth about one narrow thing and nothing about the identity or intent of the message. The 2024 Verizon Data Breach Investigations Report puts pretexting, the category that covers most business email compromise, at the top of the social-engineering incident list, with a median transaction near 50,000 dollars, and the FBI's 2023 Internet Crime Report tallied business email compromise losses at roughly 2.9 billion dollars for the year. Reply-redirect RFQs like this one are how those figures get built, one answered quote at a time.

The defenses are unglamorous and effective. Treat a display name with no address behind it as a red flag, not a quirk. Verify any new vendor or buyer through a known channel before quoting or paying. Watch the Reply-To as closely as the From. And pair that discipline with detection that weighs behavior rather than payloads, because the next RFQ with a hollow header is already drafted.

Curious how much of this your current gateway waves through? Measure the gap.

See You Next Time

Header forgery does not need malware. Sometimes the most revealing thing in an email is the field left empty.