The Phish That Rode Postmark Into a Flipbook

The sender alias read infodonotreply-|386197099538619709953861970995.

That is not an obfuscation attempt. It is a variable the sending kit never filled. Look at the digits and they resolve into a single ten-digit value repeated three times, which is what happens when a template concatenates a field onto itself and no one runs a test send before pushing the list.

The subject was as flat as the alias was loud: Review the revised content and confirm completion. No brand, no invoice number, no threat of account closure. It landed in a mailbox whose entire working day is revised deliverables and completion sign-offs, which is the only targeting this message needed. A document review request is not an anomaly in that workflow. It is the workflow.

Underneath the one visible call to action sat the part worth studying. The link made two hops, and both of them belonged to companies with nothing to do with this attack.

Hop One: A Click Tracker You Cannot Block

The first hop was hxxps://track[.]pstmrk[.]it, the click-tracking domain operated by Postmark, a transactional email provider used for receipts, password resets, and application notifications.

When a Postmark customer enables link tracking, every outbound link in their mail is rewritten to pass through that hostname so clicks can be counted. The domain therefore carries traffic for the entire customer base. Adding it to a blocklist means breaking password reset links and order confirmations across every business on the platform, so nobody does it, and the attacker knows nobody does it.

The delivery envelope matched that picture exactly. The connecting relay at 50[.]31[.]205[.]206 produced an SPF pass for an envelope sender domain of pm[.]mtasv[.]net, and the message carried a valid DKIM signature for ab[.]mtasv[.]net. Both are Postmark sending infrastructure. Composite authentication returned a pass.

The header From domain was something else again: an established business domain, registered roughly a quarter of a century earlier, with a Postmark-integrated notification setup behind it. Nothing about it reads as disposable. There is no registration age to hold against it, no lookalike spelling to catch, and no reputation deficit to score. The reply address was identical to the visible sender address, so there was no diversion to flag either, which removes one of the most reliable structural tells in payment and document fraud.

Hop Two: The Lure Lived in a Flipbook

The tracked link resolved onward to a page on online[.]fliphtml5[.]com, the hosting domain of FlipHTML5, a platform that turns uploaded documents into browsable digital flipbooks.

The appeal is the same as the first hop, one layer down the stack. An account is free to create, the upload becomes a page on a shared hostname with valid TLS, and the rendered result genuinely looks like a document viewer, because it is one. A lure asking someone to review revised content is a very short walk from a platform whose whole product is displaying content for review. That maps cleanly to MITRE ATT&CK T1566.002, Spearphishing Link, with the click itself falling under T1204.001, User Execution: Malicious Link and the notification costume under T1656, Impersonation.

One detail deserves to be stated plainly rather than dressed up. The automated URL scan of that link came back clean. No engine flagged the destination, and this write-up is not claiming the hosted page was proven hostile. That is the point of the pattern, not a gap in it. A scanner asked to judge a freshly uploaded page on a reputable publishing platform is being asked to judge a host with good history and content with no history, and the host is what it can measure. This is the same shape as any other malicious URL delivered through trusted infrastructure: the verdict describes the hostname, and the attacker only rented the hostname.

See Your Risk: Calculate how many threats your SEG is missing

The Authentication Result That Gets Misread

It is tempting to file this under all checks passed. The header block does not actually say that.

SPF passed. DKIM passed. DMARC returned none, meaning the domain in the visible From header published no policy at all. Nothing in the chain evaluated whether the passing identifiers, both of them provider domains, aligned with the domain a human reads in the sender line. They did not align, and the misalignment cost nothing, because there was no policy asking the question.

That distinction matters for triage. DMARC is a domain owner's instruction about what to do with unaligned mail. A result of none is not a pass and not a failure. It is an absence, and an absence paired with a first contact from a domain your organization has no history with is a signal in its own right. Read as reassurance, it becomes cover.

What Detection Actually Had to Work With

Strip out the things that were not available here and the list gets short. No attacker domain. No failing authentication to anchor on. No attachment. No hostile URL verdict. No aged-domain deficit or lookalike spelling.

What remained was behavior. This was a first-time sender for the organization at a high sender risk level, arriving with a body whose sender alias contained an unrendered template variable, carrying a click-tracked link into a shared content host. IRONSCALES automated triage resolved the report as phishing on that combination of signals rather than on any single verdict, and the case was not downgraded to a false positive despite the clean scan. Those relational signals are exactly what an Adaptive AI model reads when there is no attacker infrastructure left to score.

Those human-facing signals are where the exposure sits. The 2024 Verizon Data Breach Investigations Report measured a median of 21 seconds from opening a phishing email to clicking the link, and put the human element in 68% of breaches. Twenty-one seconds is not enough time to hover a rewritten tracking URL and reason about where it terminates.

Practical Controls for Relay Chains

Resolve tracked links to their terminal destination during analysis and judge that, not the wrapper. A verdict rendered on an ESP click-tracking hostname is a verdict about the ESP.

Treat consumer content-publishing platforms as their own trust class, the way mature programs already treat file-sharing links. Flipbook publishers, form builders, and document viewers all offer the same trade: free hosting on a hostname you cannot afford to block.

Alert on template artifacts in the display name and sender alias, not just in the body. Raw variable syntax, doubled tokens, and literal placeholder values are cheap high-signal indicators, and they show up in the field a mail client renders most prominently.

Finally, treat a DMARC result of none from an unknown sender as an open question rather than a clean bill of health. The CISA phishing guidance argues the same structural case for layered, behavior-aware controls, and the NIST definition of phishing is about deceiving a reader, which no header check has ever been able to measure.

Indicators of Compromise

The Bottom Line

Two reputable platforms, one after the other, and the attacker paid nothing for either reputation. When the infrastructure is borrowed end to end, blocklists and URL verdicts run out of things to say, and what is left is relational: has this sender ever written to us, does the visible domain stand behind its own mail, and does the message look machine-generated. A placeholder nobody rendered answered the last one. Assume the next kit gets tested.