The Union Benefits Domain That Was Seven Weeks Old

The sender address was simon@ibew-member-benefits[.]org, and the pretext was member benefits news from a well-known electrical workers' union. It reached an engineering supervisor at a specialty bioprocess manufacturer, which is exactly the mailbox this lure was built for. Licensed electrical professionals get real mail about code revisions, certifications, and trade association programs, so a notice about a forthcoming revision of the national electrical code lands inside an existing habit rather than outside it. The subject cited a specific forthcoming edition of that code by year, which is a detail worth noting for what it does: it makes a generic promotional message read like a compliance deadline.

Before anything else, two of the most suspicious looking artifacts in the delivered message have to be handed back to the defenders who created them. The subject line arrived with a bracketed warning label, [Possible Phish Fraud], prepended by the recipient organization's own mail gateway. Every link in the body had been rewritten through that same gateway's click protection service. Neither is attacker tradecraft. Read either one as evasion and the real case evaporates, because what remains is quieter.

A benefits domain seven weeks old

The sending domain had been registered roughly seven weeks before the message went out, through a registrar that shielded every WHOIS field behind a privacy service. No registrant name, no organization, no administrative contact, nothing connecting the domain to the century-old union whose initials it carried in the label. Adaptive AI flagged exactly that, calling it a newly registered return path domain of the kind typically associated with suspicious activity.

That contradiction carries most of the weight here. The recognizable initials are doing the persuading, and the registration record is the only thing in the message that argues back. An established institution's benefits program does not appear on a two-month-old domain, and it does not hide who owns it. Domain age is one of the few attributes a sender cannot retroactively manufacture, which is why it survives as a signal long after content based rules have been outrun. Acquiring a domain for this purpose is catalogued as T1583.001, and the trade off the attacker accepted is visible: a name close enough to trade on, on infrastructure too new to trust.

The link that displayed one host and pointed at another

There was one call to action, a promotional "Get Started Free" button, and it did not go where it said it went. The visible link text named an update subdomain belonging to a software vendor. The actual href pointed at a different host entirely, an email service provider redirect host carrying a numeric campaign identifier, which then resolved to genuine Apple and Google app store listings for a trade association mobile app.

Anchor text is free-form. It can say anything, and a recipient hovering to check a destination is reading a string the sender chose rather than the address the browser will resolve. When the displayed hostname and the real one diverge deliberately, the displayed string has stopped describing and started persuading. That is the case whether the endpoint turns out to be a login page or a legitimate storefront, because the deception is complete before the destination is reached. NIST's definition of phishing is built on the deception rather than the payload, and this message meets it on the link alone.

See Your Risk: Calculate how many threats your SEG is missing

Two authentication verdicts for one message

The authentication picture looks alarming until it is read in order. At original submission the message passed SPF and passed DKIM, signed by a Google Workspace signing domain derived from the lookalike apex domain itself. The attacker had provisioned a real Workspace tenant on the domain they registered, so the mail was properly signed and properly authorized for the domain it claimed. It claimed the lookalike, not the union.

At the final receiving hop, SPF failed and DKIM failed. That failure belongs to the recipient organization's own gateway, which relayed the message onward from a different address and broke alignment on the way, a routine consequence of an inbound security hop rather than a spoofing attempt. Anyone treating the terminal verdict as the whole story would conclude the sender forged the domain. Anyone treating the original pass as the whole story would conclude the sender was verified. Both readings are wrong, and both are common. Authentication under RFC 7489 settles whether a message is entitled to use a domain, never whether that domain is entitled to a name.

Fifty-six percent was the honest number

Adaptive AI scored the message at 56% confidence and labeled it credential theft. No login page and no credential form were ever observed, and every scanned link returned a clean verdict. That moderate score is right rather than a miss, because it describes genuine ambiguity: the identity claim was clearly fraudulent while the destination was not demonstrably malicious. A freshly registered lookalike domain running a mismatched link deserves to be flagged regardless of where the redirect happens to land, and a case with no payload to point at deserves less than full confidence.

Deceptive lead generation and app install pushes live in that gap on purpose. There is nothing for a scanner to detonate, so a clean verdict is the expected result rather than an exoneration, and the surviving question is only whether the sender is who they say they are. Weighing a fresh registration against a borrowed institutional name and a divergent href is judgment work, which is what Themis exists to do in place of a rule waiting on a known bad string. In manufacturing, where trade and compliance mail is genuinely routine, that judgment is the difference between a flag and a click.

What the clean verdict did not settle

The 2024 Verizon Data Breach Investigations Report measures the median time from opening a phishing email to clicking a link at 21 seconds, and to submitting data at 28 seconds. Nobody inspects an href on that clock. The link text is the entire inspection, and here the link text was engineered to pass it. The same report finds the human element present in 68% of breaches, which says less about carelessness than about how little time email leaves for verification.

The practical control is not URL inspection at all. It is sender history. A benefits program the recipient has never corresponded with, on a domain with no age and no ownership record, is anomalous before any link is examined. Rewriting URLs through a protection service helps at click time, and in this case it worked as designed, but it cannot tell a recipient that the institution named in the domain never registered it.

Indicators of Compromise

MITRE ATT&CK Mapping

CISA's phishing guidance on stopping the attack cycle treats sender verification as the control that survives when the payload is unremarkable, which is the situation this message engineered.

See You Next Friday

The most useful thing about this case is how little of it was technical. Authentication passed at the source. The links scanned clean. The endpoint was a real app listing on a real storefront. Strip away the two artifacts the recipient's own gateway contributed and what remains is a name that was not earned and a hostname that was not disclosed. That is enough to call it deceptive, and it is worth remembering that the next message from a domain like this one will not necessarily end somewhere harmless.