Same Thread, Same Name, a Four-Day-Old Domain

The message arrived as a reply, not as a first contact. It dropped into a request-for-quote thread that a senior lending executive at a nonprofit community development lender had been working for days, and it quoted that executive's own previous message back to them, verbatim, beneath a display name they had been corresponding with all week. The person named in the From line was real: the director of a small rural public library district, an institution that had held the same domain for two decades.

The domain on this message was not that one. It had existed for four days.

What Two Registration Records Showed

The impersonated institution's real domain carries the registration record you would expect of a small public body with no reason to hide: created twenty years before this message landed, with a named registrant, a working street address, and a published phone number.

The sending domain's record was four days old at the moment of send: a mass-market retail registrar, every registrant field replaced by a privacy service, and by the time the incident was written up the registrar had already moved the name to clientHold, the status that pulls a domain out of DNS resolution entirely. The name itself was ccbplib-us[.]com, which adds one character to the front of the institution's real label and folds its country-code top-level domain into the name, ahead of .com. In a reply, on a phone, under a familiar display name, that is not a difference anybody reads.

The pairing is the transferable signal: a long-established, publicly documented organization on one side, a four-day-old privacy-shielded near-copy of its name on the other, and the same human name on top of both. The library's own domain was never compromised and never sent any of this mail.

The Authentication Line That Reads Like a Pass

The receiving gateway recorded four results, and they are worth reading in order. SPF returned none. The lookalike domain published no record designating the host that sent the mail, so there was nothing to evaluate. DKIM returned pass, and this is the part that matters: the signing domain in that signature was ccbplib-us-com[.]20230601[.]gappssmtp[.]com, the default hosted-mail signing domain generated for the lookalike domain itself. The attacker had stood up a mailbox on a mainstream business mail platform and signed their own mail with the keys it issued. DMARC returned none, with an action of none, because the lookalike domain published no policy asking any receiver to do anything. Under RFC 7489 that is a request for no enforcement, and receivers honored it.

Composite authentication then returned pass. The basis recorded in the header was alignment: the DKIM signature matched the domain in the From header. Both belonged to the attacker.

Every one of these checks answered correctly the question it was built to answer. None was asked the only question that mattered, which is whether this was the domain the recipient had actually been talking to. That gap is why business email compromise survives in environments with clean authentication posture. The 2024 Verizon Data Breach Investigations Report puts pretexting, the category that holds BEC, at the top of the social engineering pattern, with a median transaction near fifty thousand dollars. None of it requires a forged header.

See Your Risk: Calculate how many threats your SEG is missing

Where the One Link Actually Went

The message asked for exactly one action: open the project specifications. In the delivered copy that link sat inside the recipient's own link-rewriting layer, so the visible destination was the security tool, not the target. Unwrapped, it resolved to a short link on nam[.]dcv[.]ms.

That host is Microsoft's own short-link service for Dynamics 365 Customer Voice, its survey and form product, with a region prefix for North America. The attacker did not register it and did not compromise it. It is a multi-tenant surface where anybody with a tenant can publish a form and hand out a link wearing Microsoft's hostname and reputation. Static link analysis rated the destination clean, the correct answer to the question it was asked.

What rendered behind that token at click time is not in the record: no screenshot was captured, and there is no evidence here of a specific credential page. What can be said is narrower and still useful. The sole action requested by a message that had already faked an identity pointed at a form-hosting service with a documented history of this abuse, and the check meant to evaluate that pointer returned a verdict about Microsoft.

The Two Details That Refused to Line Up

Neither tell was an authentication result.

The first came from sender analysis. The organization had a real correspondence history with this human name, on a different domain. A known contact on a first-time-seen domain is a weak signal alone and a loud one when the message continues a live negotiation. It is the same relationship break that sits under vendor email compromise, reached here without compromising any vendor.

The second was inside the HTML. The signature block carried a contact phone number that did not match the number the impersonated institution publishes, off by several digits in a way that reads like a signature rebuilt by hand rather than copied. It is a small error, and one that surfaces only when something compares the message against what the outside world publishes about the sender it claims to be.

Adaptive AI scored the message at 88% confidence and tagged the recipient as a high-value mailbox. Both targeted mailboxes were quarantined the following day, and a human analyst approved the mitigation rather than reversing it. One footnote is instructive: the automated label first bucketed this as bulk mail, even while the same analysis correctly described the lookalike mismatch. A targeted reply into a named executive's live deal thread is not bulk mail, and a triage bucket is not a verdict.

What This Changes About Trusting a Thread

Thread continuity is not an identity check. Quoted history and a familiar display name are the two cheapest things in an attacker's kit, because both are copy-and-paste. Anything in a live thread that moves money, changes scope, or relocates a document deserves a fresh read of the full sending address, plus a callback on a number sourced independently of the mail.

A DKIM pass on a domain you have never seen before is the attacker's DKIM, not a character reference. And do not expect DMARC to cover this: policy protects the exact domain that publishes it, so the institution being imitated had no lever to pull. CISA's phishing guidance and the NIST definition both frame the technique as an attack on a human trust relationship, which is where this one landed.

Host reputation is also not link reputation. When the payload sits on a platform serving millions of legitimate links, the only anomalies left are behavioral: a first-seen domain, an off-graph identity, a signature that contradicts public record, an ask that leaves the conversation. That combination is what to alert on, because the headers will keep coming back clean.

Indicators of Compromise

MITRE ATT&CK Mapping

The Signal Worth Keeping

The strongest control here was not a check on the message. It was the organization's memory of who it had been talking to, and on which domain. Authentication told the truth about a domain nobody should have trusted, and link analysis told the truth about a platform nobody needs to block. Neither was ever asked about the substitution.