The Super Lawyers Message Addressed to Super Lawyers

The message was addressed to Super Lawyers. Its To line read secure@superlawyers[.]com, its Reply-To read do_not_reply@superlawyers[.]com, and the attorney it was actually aimed at appeared nowhere in the visible headers.

Only one field told the truth. The From address belonged to an unrelated small law firm, and that firm's mail server signed the entire costume with a valid DKIM key.

The subject was "Secure Message on SuperLawyers.com." The body said another attorney had just sent a secure message on Super Lawyers, with a single "Click here to view message" link. The target was a board-certified real estate attorney at a U.S. law firm, exactly the kind of professional whose directory profile is part of how clients find them.

A Reply-To built to go nowhere

Most Reply-To tricks are diversions. The From looks legitimate, and replies quietly route to a mailbox the attacker reads. That pattern has been covered here before, and it is not what happened in this case.

Here the Reply-To pointed at the impersonated brand's own no-reply address, under the sending attorney's display name. Hit reply and you see a colleague's name, but the message heads to an address the brand labels do-not-reply. There is no thread to continue, no follow-up question for a defender to intercept, and no attacker mailbox to burn.

That is reply-path suppression. The attacker wanted no conversation at all. Only the click.

Setting To to the brand's secure inbox finishes the illusion. The message reads as a relay: another lawyer messaged you through the directory, the platform's secure inbox received it, and the platform passed it along. The victim's own address arrived by Bcc, and the X-MS-Exchange-Processed-By-BccFoldering header is consistent with that delivery. Bcc alone proves little, since plenty of legitimate mail uses it. What matters is what the visible addressing claims to be.

The sender's key signed the brand's costume

At the current Microsoft hop, everything authenticated: spf=pass, dkim=pass, dmarc=pass, compauth=pass reason=100. All of it for the sending law firm's domain. None of it for Super Lawyers.

The DKIM signature's header list included from, reply-to and to. The unrelated firm's key cryptographically vouched for a To and Reply-To set to someone else's brand. DMARC aligns only the From domain, so a brand that lives in To, Reply-To, the subject, the body and the URL path is never checked by anything.

The origin hop shows from localhost ([127.0.0.1]) with ESMTPSA, an authenticated same-machine submission, alongside a Firefox on Windows user agent and Outlook Web composition artifacts in the HTML. That is evidence against header forgery. The record proves an authenticated submission from that firm's account and nothing more. The sending firm's own outbound filter even annotated the message multiple_from_replyto and delivered it anyway with a score of 0. Microsoft rated it SCL 1.

In MITRE ATT&CK terms this is T1566.002, Spearphishing Link, wrapped in T1036 masquerading and aimed at T1598.003 information gathering.

A pretext aimed at the profile, not the inbox

The landing page was a full Super Lawyers clone. It announced that the directory had "migrated our authentication system" and asked the attorney to "verify ownership of your connected work email." Three steps followed: select your email provider, access your email to verify ownership, upgrade your profile and access your secure messages. A "You have a new secure message!" badge sat above a provider dropdown.

This lure targets professional identity rather than a mailbox. For attorneys, a directory listing is business development. A message from a peer through that directory, plus a profile upgrade, is a believable reason to act. The page asks the attorney to pick an email provider to verify the work mailbox. Only that first step was observed, and it is the opening of a credential-capture flow.

The brand cues were real. The logo was hotlinked from the genuine Martindale marketing asset host, and the footer copied the genuine FindLaw postal address and phone numbers. Nothing about the brand's own systems was involved.

The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches and credentials in 39% across the full kill chain. Pretexting accounts for 6% of initial access vectors. A directory-profile pretext is where those numbers meet.

See Your Risk: Calculate how many threats your SEG is missing

Read the URL from the left

The single link was hxxps://only[.]qa/sm[.]superlawyers[.]com/messages/?sndr=[redacted]&wml=. The brand hostname rides in the path. The actual host is a .qa domain whose WHOIS returned no registrar or creation data, with parking-service nameservers. Its ownership is unknown.

The sndr= parameter carried the sending attorney's display name in base64, redacted here. A second parameter, wml=, was present but empty.

The link scanner returned Clean, even though its stored screenshot shows the clone rendered in full. The gap was between the verdict and the rendered content, not cloaking.

What caught it, and what to tune

The message passed every authentication check, scored as clean mail, and carried a clean URL verdict. Themis flagged it at 50 confidence, and the community insight noted that similar incidents had resolved as phishing. That crowdsourced threat intelligence signal, combined with a human analyst's malicious verdict, decided it. The mailbox was quarantined and the incident closed as malicious.

IRONSCALES platform data, drawn from 36,000+ security professionals across 18,000+ organizations, shows 67.5 phishing emails per 100 mailboxes each month. A share of them will look exactly like this one.

What to tune:

• Compare the one authenticated identity to every brand cue. If SPF, DKIM and DMARC pass for a domain unrelated to the To, Reply-To, logo and footer, the authentication is describing a different sender than the message claims.
• Flag brand-addressed To lines. A message whose visible To is the brand's own address, with the recipient present only by Bcc, is posing as a relay.
• Treat a no-reply Reply-To under a person's name as a tell. Real peers want answers.
• Treat "pick your email provider to verify" as a credential prompt, and route it through credential harvesting protection rather than user judgement alone.

CISA phishing guidance and the NIST definition of phishing both center on impersonating a trusted entity. The FBI IC3 2024 report and the Microsoft Digital Defense Report 2024 both track how credential theft feeds larger fraud. This lure shows the trusted entity no longer needs to send anything. The attacker only has to dress the headers as if it did.