Business Email Compromise: Mapping a Lookalike Domain's Public Infrastructure

Illustrative composite example. This case file combines and alters details from several scenarios to show how a TraxIntel review is scoped, checked, and reported. Names, figures, platforms, and outcomes are representative; it does not describe a specific customer, it is not a testimonial, and it is not a promise of results.

The work described stays within public sources and customer-provided material, is reviewed by an analyst before delivery, and involves no contact with the people in scope. TraxIntel does not access private accounts or messages, does not recover deleted content, does not track anyone's live location, and does not guarantee identification.

Background

A company's accounts payable department wired $340K to a fraudulent bank account after receiving a convincing email that appeared to come from their CEO. The message mirrored the executive's tone and referenced a plausible, time-sensitive payment, and by the time the discrepancy surfaced, the funds had already been moved out of the initial receiving account. The engagement mattered because business email compromise rarely leaves an obvious trail: there is no malware to reverse-engineer and no single breached server to examine. What remains is a scatter of public artifacts — a look-alike domain, mail-routing metadata, and a downstream chain of accounts — that only becomes meaningful when it is assembled and cross-referenced against prior, documented activity.

Investigation Methodology

The review drew exclusively on publicly available and lawfully obtained records. No systems were accessed, and nothing about the sender was deanonymized.

1. Email header analysis. The phishing message's headers were examined for originating infrastructure — mail servers, relay hops, and the pass-or-fail results of standard authentication mechanisms — to establish where the mail plausibly originated rather than merely what the display name claimed.
2. Domain infrastructure mapping. The sender's look-alike domain was profiled through public registration records, WHOIS-style registrar data, passive DNS history, and hosting fingerprints, then pivoted to surface other domains sharing the same operational footprint.
3. Certificate and web-artifact review. Certificate transparency logs and the domain's SSL issuance chain were compared against certificates observed in previously reported campaigns.
4. Published-reporting comparison. The combined fingerprint was compared with business email compromise patterns described in published industry threat reporting.
5. Payment-record organization. The company's own wire records were organized so its bank could file a recall request quickly.

Key Findings

• The lookalike domain was registered days before the payment request through a registrar and hosting provider that public industry reports associate with earlier business email compromise campaigns.
• The domain's certificate-issuance pattern resembled patterns described in those published reports, which is more consistent with a reused playbook than with coincidence, though it is not proof of a shared operator.
• The company's own payment records showed where the wire went, giving its bank a documented starting point for a recall request.
• Several related lookalike domains sharing the same hosting footprint were still live and were flagged for abuse reporting.

Evidence and Sources

The conclusions rested on classes of public evidence rather than any single artifact: mail-transit metadata, public domain and registrar records, certificate transparency data, hosting and passive-DNS history, and published threat-intelligence write-ups describing similar campaigns. Corroboration was deliberately multi-signal. A registrar match on its own is weak; a registrar, a hosting pattern, and a certificate-issuance pattern that all resemble published reporting form a more defensible picture, while still falling short of attribution. Each linkage was recorded with its underlying source so that a reviewer could retrace it independently rather than take the conclusion on trust.

Limitations and Review Notes

Resemblance to published campaign reporting is a correlation, not attribution to a named group or individual, and it does not prove who sent the email. Public records can be incomplete, deliberately obscured behind privacy services, or shared across unrelated tenants, so a human analyst reviewed every pivot before it was relied upon and discarded links that could not be independently supported. Registration and certificate patterns can be imitated, and timing means some downstream funds may already have moved beyond reach. Nothing in this review establishes intent for any third party, and none of it substitutes for the formal process that a law-enforcement referral triggers.

Outcome

The company filed a report with the FBI's Internet Crime Complaint Center that included the infrastructure analysis, and its bank pursued a recall request through banking channels. Abuse reports were sent to the registrar and host for the related lookalike domains. Any freeze or return of funds was decided by the banks and law enforcement, not by TraxIntel; the value of the package was that it arrived as a corroborated, source-linked record rather than a raw tip, which helped the company act quickly.