Legitimate subdomains versus full lookalike domainsA familiar name in a sender address does not prove that the message came from the organisation it names. Attackers can place convincing content inside a real…Why a Rising Domain Score After a Sale MattersA trust score is a useful warning light for email senders, not a certificate of innocence. A trust score that increases after a domain is sold should be…Cross-referencing sender domains with malicious hash listsHow to use the API to cross-reference sender domains against known malicious hash lists starts with separating sender identity from threat intelligence. A…DMARC p=none and a recent MX changeA DMARC policy of p=none combined with a recent MX record change can look alarming, but the two DNS settings describe different parts of email delivery. DMARC…Threat hunting playbooks with sender domain trust scoresSpoofed and lookalike sender domains can make fraudulent emails resemble routine Australian business communications. A useful threat hunt connects domain…Why Compromised Cloud IPs Become SPF-Authorised TargetsSender Policy Framework (SPF) is a DNS-based list of sources permitted to send email for a domain. Mail servers query that list before accepting or forwarding…Stop phishing emails that impersonate trusted sendersPhishing emails can copy the display name, logo and tone of someone you know, making a fraudulent message look routine in a crowded inbox. A display name does…What many DKIM selectors on one domain meanA large number of DKIM signatures from different selectors on one domain is usually a signal to investigate, not automatic evidence of phishing. A selector is…Compare sender reputations during a domain mergerWhen an Australian organisation absorbs another company, the merger can leave two domains sending similar messages to the same customers. This guide explains…Why an expired SSL certificate can leave a domain dangerousAn expired SSL certificate—more accurately, an expired TLS certificate—does not automatically make a domain malicious. It does mean the site’s encryption…