Not Scanned Is Not Clean: The DANFE Link With No TLD

The only link in the message pointed at a hostname with no dot in it. No .com, no .br, no top-level domain at all. The URL scanner looked at it, found nothing to look up, and recorded the verdict as "notscanned".

Not malicious. Not clean. Nothing.

Every other reputation layer matched that silence. Microsoft assigned a spam confidence level of 1 and delivered the message to the Inbox. Vade scored it 0. The message a human analyst later resolved as malicious passed three filters without a single negative mark, because none of them had anything to score.

A Verdict That Is Really an Absence

The lure reached a Brazilian non-profit technology research and innovation institute on October 20, 2026, addressed to a senior member of the development staff. It was a Portuguese-language fiscal document notice: a DANFE (the printed summary of a Brazilian electronic invoice) with an invoice number, an issue date, the recipient's own mailbox echoed in a details row, and one blue button labeled "Baixar DANFE" (Download DANFE).

The button's href was hxxps://marxcal292e/nf/index[.]php.

marxcal292e is a single-label name. It cannot resolve in public DNS. There is no registrar to query, no WHOIS record, no certificate, no page to render. A reputation engine built to answer "what do we know about this domain?" never gets a question.

That is the gap. "Notscanned" is a missing data point, and any control that only acts on a positive malicious verdict fails open the moment a URL is malformed enough to fall outside the lookup.

Every Reputation Layer Had Nothing to Say

Here is what each control actually recorded:

The message came from a consumer account on a major Brazilian ISP's freemail service, so the provider's own legitimate servers signed and sent it. That result is context, not the story. Freemail authenticating as freemail proves the provider is real. It says nothing about the person typing. The record does not establish whether the account was registered for this or belongs to someone else, so we treat the account holder as unknown.

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access and finds the human element in 62% of breaches. Its gateway telemetry (Figure 54) shows plain phishing at 80% of the email attacks gateways block. Those are the attacks reputation handles well. A link with no reputation at all sits outside that model, and a secure email gateway (SEG) that leans on URL verdicts inherits the blind spot.

See Your Risk: Calculate how many threats your SEG is missing

The Shape of a URL Is Still a Signal

Two things caught this message, and neither depended on the link's reputation.

The first was content and language analysis. Themis, the IRONSCALES agentic AI analyst, labeled the message Credential Theft at 56% confidence, drawing on wording and structure cues in the body plus community insights from 36,000+ security professionals across 18,000+ organizations. A human analyst then resolved the incident as malicious.

The second was structural analysis of the URL itself. The agentic link analysis found a host with no TLD, an NXDOMAIN response, no WHOIS and no SSL. It could not fetch any content. It rated the link high risk anyway (0.80 risk, 0.70 confidence) and recommended blocking on structure alone.

That is the right instinct. An automated invoicing system does not send customers to a dotless hostname. A fiscal notice whose only action points at a name that cannot exist on the public internet is anomalous by construction. You do not need to know where a link goes to know the link is wrong.

We cannot tell you where it would have led. The record holds no landing page, no screenshot and no resolution. "Credential Theft" is the Themis label for the message, not an observed harvest. The record also does not say why the host was shaped this way, and we will not guess.

Other body cues supported the content verdict. The subject promised the NF-e XML file while the body offered the DANFE download. Literal markdown code-fence characters wrapped the inner template table. The closing signature named a person who did not match the sending account's display name.

A Broken Link Does Not Mean a Dead Campaign

About 85 minutes after the first message arrived, the same mailbox received a second one from the campaign. New subject, same theme: a DANFE "for tax verification" with a "possible tax adjustment".

The body of that second message was not retrievable from this incident, so we cannot say what its link did. The behavior is what matters. Someone sent again, with a reworded pretext, to the same person.

Both messages were quarantined, and the second was permanently deleted.

If your triage logic closes a report because "the link doesn't even resolve," this case is the counterargument. A sender iterating on subject lines against one target is running a campaign.

Mapping the Mechanics and Indicators

• T1566.002, Phishing: Spearphishing Link: the "Baixar DANFE" button is the delivery vehicle, even with an unresolvable host.
• T1036, Masquerading: the template poses as an automated fiscal-document notice.

The sending servers belong to the ISP and are not attacker infrastructure, so they are not listed as block indicators.

Treat No Verdict as Its Own Verdict

• Give "not scanned", "unknown" and "no verdict" their own policy instead of a pass. Measure how often your stack returns them.
• Score URL structure independently of reputation. A single-label host, a missing TLD or an NXDOMAIN on a call-to-action is an anomaly on its own. Advanced URL protection should judge the shape of a link, not only its history.
• Keep content and language analysis, such as Adaptive AI, in the decision path whenever every link in a message is unscored.
• Correlate repeat sends to one mailbox across subject changes before closing any single report.
• Keep users reporting. CISA phishing guidance treats reporting as a core control, and NIST defines phishing by the deception, not by the infrastructure behind it.

The volume argument has not changed either. The FBI IC3 2024 report again logged phishing and spoofing as the most-reported complaint type, and the IBM Cost of a Data Breach 2024 report lists phishing among the most common initial attack vectors.

A filter that waits for a bad verdict will wait forever on a link that never gets one.