The Phishing Email That Carried Its Own Mailer's Path

The phishing email carried a map to the attacker's mailer. One header on the message recorded the exact folder the sending script ran from: a chain of random-named directories, geouzds/rjt1buw/ndztbpc, nested inside the WordPress core wp-includes/sitemaps directory of a small business website that has been online since 2010.

That same detail explains the result every perimeter check returned. SPF passed. DKIM passed. DMARC passed, with a quarantine policy in place. The message reached an accounting mailbox at a global pharmaceutical manufacturer, and Microsoft scored it SCL 1 and delivered it to the inbox.

Nothing about the authentication was forged. The compromised domain's own hosting account sent and signed the mail.

The Headers That Named the Folder

Shared cPanel hosting running Exim stamps outbound mail with anti-abuse fields so the host can trace spam back to the account responsible. Most analysts skim past them. On this message they read like a crime-scene report.

X-Source-Dir gave the working directory of the process that handed the message to Exim: the planted folder inside wp-includes/sitemaps. X-Get-Message-Sender-Via showed an authenticated_id tied to the site's local hosting account. X-Authenticated-Sender named the compromised site's own support mailbox. The origin Received hop read "with local (Exim 4.100)", meaning the message was submitted on the hosting server itself, not by an external SMTP client logging in from somewhere else.

Put together, that is script mail. Something running inside the website's file tree generated the message and passed it straight to the local mail server.

WordPress core never sends mail from a three-deep random folder under sitemaps. That location is chosen to blend in with legitimate core files a site owner rarely opens. How the attacker got write access is not in the record, and the site owner is a victim here, not a suspect.

Why Every Check Came Back Green

This is where a lot of defensive thinking breaks. A DMARC pass is often read as "this sender is who they claim to be." It only proves that the domain's authorized infrastructure sent the message and the signature aligned.

Here, that was literally true. The mail left the host through the provider's outbound gateway, an IP explicitly listed in the compromised domain's SPF record. The host signed it with the domain's own DKIM key. The recipient's perimeter gateway recorded spf=Pass, dkim=pass and dmarc=pass in its original authentication results.

The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches and phishing at 16% of initial access. A lure that arrives fully authenticated from a 16-year-old domain with no bad history is built to land squarely on that human element. The Microsoft Digital Defense Report 2024 describes the same trend more broadly: attackers borrowing legitimate infrastructure to inherit its reputation.

The gateway did notice something. It placed the sending source in a SUSPECTLIST sender group with a throttled mail-flow policy and a reputation score of minus 1.9. Then it delivered the message anyway.

See Your Risk: Calculate how many threats your SEG is missing

The Failure the Recipient Caused Itself

Look at the final Microsoft hop and the picture flips: spf=softfail, dkim=fail with a body hash that did not verify, dmarc=fail action=quarantine, compauth=none.

An analyst who reads only the current hop might conclude the attacker altered the message in transit. That would be wrong. The recipient's own secure email gateway (SEG) rewrote the body link for click-time inspection, and Safe Links wrapped it again. Changing the body broke the DKIM body hash downstream. The softfail is the recipient's own gateway IP relaying to Exchange Online.

The order of hops settles it. The gateway's pre-rewrite results show a clean pass. The failures appear only after the recipient's own rewrite. Read the DMARC verdict at the hop before your own infrastructure touched the message, not after.

A Legal Threat With No Attachment

The lure itself was a plain notice in Hebrew. The display name claimed to be the Israeli police. The body claimed to come from the Ministry of Justice and the State Attorney's Office, warned that ignoring it could lead to further legal proceedings, and told the reader to review "the attached document" as soon as possible.

There was no attached document. The only attacker content was a link to a Windows installer, isrelherp.msi, on a Cloudflare-fronted .es domain. The gateway's file analysis logged SKIPPED (no attachment in message). Promising an attachment while delivering a link moves the payload out of reach of the sandbox that would have opened a real file.

What the installer does is unknown. A direct fetch returned HTTP 403, the file was never retrieved, and the link scan returned a partial verdict. We are not going to guess at a malware family.

Government impersonation is a standing category in the FBI IC3 2024 report, and CISA phishing guidance tells users to verify official notices through known channels. Authority pressure plus an installer link is a pattern that advanced malware and URL protection has to catch at the link, because there is no file to detonate.

Mapping the Chain

What Caught It, and What to Hunt For

No automated verdict stopped this one. The accounting employee reported it, a human analyst marked it malicious, and the message was moved to Junk. That is the case for making reporting a first-class detection signal, backed by a community of 36,000+ security professionals across 18,000+ organizations (IRONSCALES platform data) whose reports feed the same models.

For detection engineering, the sending side is the lesson:

• Treat X-Source-Dir as signal. A path inside wp-includes, wp-content/uploads or any random-character subfolder means a script on a web server sent the mail.
• Read authentication per hop. Trust the result recorded before your own gateway rewrote anything, and treat rewrite-induced DKIM failures as your own artifact, not attacker activity.
• Flag the attachment mismatch. Body text that promises an attachment on a message with zero attachments is cheap to detect and rarely legitimate.
• Do not let DMARC pass end the triage. First-time sender, no prior correspondence, legal urgency and an installer link outweigh an aligned signature.

The IBM Cost of a Data Breach 2024 report keeps phishing among the most common and expensive breach vectors. This message was authentic in every way a protocol can measure. It still left a trail, written by the server it hijacked.