A Fully Authenticated Political Donation Scam That Every Gateway Trusted

SPF passed. DKIM passed. DMARC passed. Composite authentication scored a perfect 100. And the email was a fraudulent donation solicitation impersonating a state attorney general.

This case is a clean example of why email authentication protocols alone cannot stop impersonation. The attacker registered a fresh domain, configured a legitimate email marketing platform to handle delivery, and exploited the gap between "authenticated sender" and "trusted sender" to solicit money from employees at a mid-market professional services firm.

The email hit four mailboxes. Every one was quarantined, not because authentication failed, but because behavioral and community signals flagged what protocol checks could not.

Fresh Domain, Full Authentication, Zero Friction

The attack began with domain registration. On July 23, 2025, someone registered freedom-1st[.]com through GoDaddy with full WHOIS privacy protection. DNSSEC was left unsigned. The domain sat for roughly eight months before being weaponized.

The attacker then connected the domain to EmailOctopus, a legitimate email marketing platform that routes sends through SparkPost infrastructure. This gave the campaign three things for free: SPF alignment via eom.freedom-1st[.]com, a valid DKIM signature with selector eo and header.d=freedom-1st[.]com, and a DMARC policy that passed with action=none. The Return-Path used a VERP-encoded bounce address (msprvs1=20549db1AH1yo=bounces-1873-57986@eom.freedom-1st[.]com) consistent with standard ESP campaign sends.

From a protocol perspective, this email was indistinguishable from a legitimate marketing campaign.

The Impersonation: A Public Figure's Name, Someone Else's Mailbox

The From header read "Ken Paxton" . The display name matched a sitting state attorney general. The actual sending address belonged to someone (or something) named "Carly" on the attacker-controlled domain.

This is display-name impersonation at its most effective. Most email clients render the display name prominently and tuck the address behind a click or hover. A recipient scanning their inbox sees a recognizable public figure's name, not an unfamiliar domain.

The IRONSCALES platform had previously seen the same display name associated with a different sender address (news@magacitizen[.]com), triggering an exact display-name impersonation detection. That prior association was the first behavioral signal that something was wrong.

Political Urgency as Social Engineering Fuel

The subject line, "Cornyn is a coward," was designed to provoke an emotional reaction. The body doubled down with politically charged language attacking a sitting U.S. senator, framing the solicitation as urgent support for a rival campaign. The call-to-action button ("RUSH SUPPORT HERE >>") pushed recipients toward a donation page on secure.winred[.]com, a legitimate political fundraising processor.

This is where the attack gets clever. Every link in the email resolved to either the attacker's tracking infrastructure (eot.freedom-1st[.]com redirects, berrima.eomail8[.]com tracking pixels) or to a real donation platform. Automated URL scanners returned clean verdicts across the board. The WinRed page itself appeared functional. There was nothing technically malicious about the destination. The fraud was entirely in the false identity behind the solicitation.

The email also included standard ESP footers: an unsubscribe link, an EmailOctopus "Powered by" badge, and a "Paid for by" disclosure with a mailing address. These elements added a veneer of compliance that could trick both automated systems and human recipients into treating the message as legitimate political outreach.

See Your Risk: Calculate how many threats your SEG is missing

What the Headers Revealed

Microsoft's own anti-spam stack was not fooled. The X-MS-Exchange-Organization-SCL value was 9 (the highest spam confidence level). The X-Forefront-Antispam-Report flagged the message as HSPM (high-confidence spam) with SFTY:9.25, a safety score indicating phishing characteristics. The Bulk Complaint Level hit 7. Despite clean authentication, the email was routed to quarantine via SFV:SPM.

The relay chain confirmed the delivery path: SparkPost's mta-253-220-155.emailoctopus[.]com[.]sparkpostmail[.]com (IP 147[.]253[.]220[.]155, geolocated to the UK) handed the message to Microsoft's Exchange Online Protection frontend, which processed it through standard filtering before delivery to the target tenant.

Community threat intelligence provided additional confidence. Similar incidents from the same sender fingerprint had been resolved as phishing across the IRONSCALES network, giving our Adaptive AI an 87% confidence score before any human analyst reviewed the case.

The Technique Chain Behind Authenticated Impersonation

Attacker Infrastructure and IOCs

Why Authentication Alone Will Never Be Enough

This case is a textbook illustration of a gap the FBI IC3 2024 report keeps quantifying: BEC and impersonation-driven fraud cost organizations $2.9 billion in reported losses last year. The Verizon DBIR 2024 found that pretexting (which includes impersonation for financial gain) now accounts for over 40% of social engineering incidents. And the Microsoft Digital Defense Report 2024 explicitly warns that threat actors are increasingly weaponizing legitimate cloud services for delivery.

DMARC, SPF, and DKIM answer one question: "Did this email come from the domain it claims?" They do not answer: "Is the person named in the display name actually the sender?" When attackers register their own domain and configure authentication correctly, every protocol check passes by design.

Defending against this pattern requires:

1. Display-name correlation. Track display names against known sender addresses. When "Ken Paxton" appears from a new domain, that mismatch should trigger inspection, exactly as it did here.
2. Domain age and WHOIS analysis. A privacy-shielded domain less than a year old sending political solicitations to a professional services firm is anomalous. Weight that signal.
3. Community intelligence. Across IRONSCALES data from 35,000+ security professionals, similar messages from the same sender fingerprint had already been classified as phishing. Sharing verdicts across organizations catches campaigns that any single tenant might miss.
4. ESP header inspection. The X-EmailOctopus-* headers, campaign IDs, and VERP-encoded bounce paths provide forensic markers. Organizations can build detection rules around ESP metadata patterns that correlate with known-bad campaigns.
5. User reporting. Per CISA guidance, even technically clean emails warrant scrutiny when they solicit money under a public figure's name. Empower users to flag. The FTC's Consumer Sentinel data shows impersonation of government officials is a top fraud vector.

Authentication is necessary. It is not sufficient. When every protocol check says "pass" and the email is still a scam, the only remaining defense is understanding who is really writing to you and why.