A Days-Old Domain Sent a Calendar Invite From Yourself

A calendar invite arrived at an in-home senior-care provider. The subject line named the recipient's own company, the kind of internal-meeting language nobody thinks twice about. Every authentication check came back green. And yet the domain that sent it had existed for only a handful of days, the meeting notes inside belonged to a completely different company, and the one button that mattered did not go anywhere near an e-signature viewer.

This is what a modern, reputation-passing phish looks like when the attacker owns the infrastructure outright.

The Setup: A Calendar Invite That Passed Every Check

The sending domain, keotir[.]com, was registered just days before the attack through a low-cost hosting provider and wired straight into a bulk email service for delivery. That short setup window is the whole point. A brand-new domain has no history to hold against it, so a defender leaning on reputation scoring has nothing to score.

The message was dressed as a calendar invite carrying an agreement to review. Three mailboxes at the target company received near-identical copies, each varying only by the recipient's own name in the subject line. There was no attachment and no dollar figure in the body. The single objective was the click.

When SPF, DKIM, and DMARC All Say Yes

Here is the part that trips up teams who treat authentication as a verdict rather than a data point. The message passed Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). All three. The DKIM signature was valid for keotir[.]com, and the DMARC policy resolved to p=none.

None of that means the message was safe. It means the attacker configured their throwaway domain correctly. Authentication confirms that a domain is who it says it is. It makes no claim about whether that domain should be trusted, and a p=none policy tells receivers to take no enforcement action even on failures. When the sender owns the domain, passing SPF, DKIM, and DMARC is trivial, and it launders a days-old domain into something that looks legitimate at the gateway.

The Body Belonged to Someone Else

Open the message and the disguise falls apart. While the subject line impersonated the recipient's own company, the body was stuffed with duplicated, garbled meeting notes and a signature block from an entirely unrelated organization. It named a real employee of another company, a detail that has been anonymized here because that person was never involved and their name was simply pasted in from recycled content.

This mismatch is a tell. Attackers building lures at volume reuse text blocks across campaigns, and the plumbing does not always line up. A subject that says one thing and a body that says another is a content-versus-context conflict no reputation engine will surface, but a behavioral model reading the whole message together will.

The Click That Went Nowhere Legitimate

The lure's Open agreement button looked like a standard e-signature call to action. It resolved to nothing of the sort. The link chained a legitimate Intuit notification-tracking URL into a hijacked com_mailto helper path on bigbonvi[.]it, a compromised Joomla site, which then rendered an unrelated third-party page at statesrentals[.]net.

That is open-redirect abuse running on a compromised content management system (CMS). The attacker never had to register or defend a landing domain. They borrowed a trusted tracking service and a hijacked Joomla component to forward the browser wherever they wanted, so the visible link carried a reputable name while the destination had no connection to the agreement pretext at all. Compromised legitimate infrastructure is one of the most common ways adversaries stay ahead of URL blocklists, a pattern Microsoft has repeatedly flagged in its threat reporting.

Mapping to MITRE ATT&CK

• T1566.002 (Phishing: Spearphishing Link): the agreement CTA was the delivery mechanism, hidden behind a redirect chain. See the MITRE technique reference.
• T1583.001 (Acquire Infrastructure: Domains): the days-old keotir[.]com domain was stood up specifically for this campaign.
• T1584.001 (Compromise Infrastructure: Domains): the hijacked Joomla com_mailto component on a legitimate third-party site did the redirecting. The broader phishing technique family captures the delivery pattern.

Indicators of Compromise

What Actually Catches This

Reputation and authentication were designed to answer questions this attack never asks. The domain was too new to have a reputation, and it passed authentication because the attacker built it to. The signals that matter here are behavioral: a sending domain with no prior relationship to the recipient, a subject line whose language does not match its own body, an e-signature button that resolves through a tracking service and a redirect rather than to a viewer, and a first-contact agreement request landing in three mailboxes at once.

That is the ground Adaptive AI is built to cover. Reading the full message as a unit, comparing it against known sender relationships, and inspecting where a link actually resolves are exactly the checks that expose a self-impersonating invite whose body belongs to a stranger. Across the 35,000+ security professionals across 17,000+ organizations tracking these patterns, the recurring lesson is the same one this case teaches: a p=none DMARC pass is not a trust decision.

The 2024 Verizon Data Breach Investigations Report still puts the human element in 68% of breaches, with phishing behind roughly 15% of them, which is why detection cannot stop at the gateway. CISA's phishing guidance and Microsoft's Digital Defense Report 2024 both underline the same shift toward abused legitimate infrastructure and redirect chains.

The Takeaway

A five-day-old domain sent a calendar invite that appeared to come from the recipient's own company, passed every authentication check, and pointed at a hijacked website. If your controls stop at SPF, DKIM, and DMARC, this message walks in clean. The defense is to read intent, sender relationship, and link resolution together, not to trust a green authentication badge.

See where a self-impersonating, fully authenticated invite like this would land in your environment with advanced URL and redirect attack protection.