Same-Day .cam Domain Passed Every Auth Check

The domain was registered the same day it sent the email. It still passed SPF, DKIM, and DMARC without a single failure.

That is the detail worth sitting with. A specialty grocery and import retailer received what looked like a routine B2B sourcing inquiry, styled to mimic a LinkedIn message, and every authentication check a mail server runs came back clean. The sender did not spoof anyone. They did not compromise a trusted account. They simply bought a brand-new domain, configured its DNS records correctly, and mailed from it before the ink was dry.

Authentication was never designed to answer the question defenders actually care about. SPF, DKIM, and DMARC confirm that a sender controls the domain they are sending from. They say nothing about whether that domain, or that sender, deserves your trust. This case is a clean demonstration of the gap.

A LinkedIn Costume Over a Sourcing Scam

The email landed in a generic contactus@ mailbox, the kind of shared alias that fields legitimate vendor outreach all day. The subject line was a fabricated reply thread, "RE: ... New Order #0006774," a common trick to imply an existing conversation and lift the open rate. There was no prior thread. The reference number was invented.

The body wore two disguises at once. It used LinkedIn-style button UI to feel like a professional networking prompt, then pivoted into a Simplified Chinese sourcing inquiry asking about minimum order quantities and factory pricing. That combination is the tell of a template built to look plausible to a busy procurement inbox while casting a wide net across industries.

The single call to action was a button labeled with the Simplified Chinese characters for "Accept." Visually it echoed LinkedIn's design language. Its destination did not.

Where the Accept Button Actually Went

The button did not resolve to linkedin.com. It pointed to a u2l[.]ai shortlink redirector, and the recipient's own email address was appended to the URL as a fragment.

That fragment is the payload. This was not primarily a credential-harvesting run. It was reconnaissance. When someone at the retailer clicked, the appended email confirmed the mailbox was live, monitored, and staffed by a person who engages with unsolicited business inquiries. That confirmation turns a generic alias into a validated, high-value target for the next campaign. Mailbox validation at scale is how attackers convert a spray into a curated list.

The technique maps to MITRE ATT&CK T1566.002, Spearphishing Link, delivered on infrastructure the attacker stood up specifically for the job, which corresponds to T1583.001, Acquire Infrastructure: Domains. The LinkedIn-style dressing over a link that leads somewhere else is textbook T1036.005, Masquerading: Match Legitimate Name or Location.

The Contradictions the Template Forgot to Fix

Reused scam templates leave fingerprints, and this one left several.

The signature block claimed the company was located in Braband, Denmark. The body text claimed the company was based in Sweden. A real business does not disagree with itself about which country it operates from. That inconsistency is what a template looks like when an operator swaps in a new brand but forgets to reconcile every field.

The geography got worse under inspection. The sending IP, 85[.]121[.]215[.]113, geolocated to Romania and carried no PTR (reverse DNS) record. Neither Denmark nor Sweden. Legitimate mail infrastructure for a Nordic firm does not route through an anonymous Romanian IP with no reverse record. The stated location, the signature location, and the actual origin were three different answers to the same question.

Here are the indicators, defanged.

Indicators of Compromise

Why Authentication Was the Wrong Question

If your stack treats a clean DMARC result as a proxy for safety, this email sails through. Everything authentication measures was in perfect order. What authentication cannot measure is what actually mattered here: the domain was hours old, the branded button pointed away from the brand it imitated, the URL carried a recipient-tracking fragment, and the sender's own claims about its location contradicted each other and the network evidence.

The 2024 Verizon Data Breach Investigations Report found phishing present in 15% of breaches, with a median time to click of just 21 seconds once a lure lands in front of a person. A shared contactus@ alias is exactly the kind of inbox where that clock runs fast, because engaging with strangers is the job. CISA's phishing guidance stresses interrupting the attack cycle early, before a click confirms a live target, and NIST's definition of phishing centers on the deception itself, not the delivery envelope. The Microsoft Digital Defense Report 2024 documents the same shift toward operationally clean, reputation-light infrastructure.

This is where behavioral analysis earns its place. Themis, our Adaptive AI, models what normal sender behavior looks like for an organization and flags the anomalies that authentication is blind to. A same-day domain, a brand-versus-link mismatch, and a tracking fragment are exactly the signal set our Adaptive AI is built to weigh together, even when SPF, DKIM, and DMARC all pass. Across 35,000+ security professionals in 17,000+ organizations, the pattern is consistent: gateways that stop at authentication miss the attacks engineered to satisfy it.

See Your Risk: Calculate how many threats your SEG is missing

Treat a green auth result as the start of the question, not the answer

The practical takeaway is narrow and worth enforcing. A passing authentication result tells you the sender controls the domain. It does not tell you the domain is old, consistent, or honest about where it is. Weight domain age heavily, inspect where branded buttons truly resolve rather than what they say, treat recipient-email URL fragments as reconnaissance, and flag senders whose own stated details contradict each other. When a mail security stack layers that behavioral context on top of authentication, as SEG augmentation is meant to, a same-day .cam domain wearing LinkedIn's colors stops being a clean delivery and becomes an obvious anomaly.