Spotting phishing from a recently trusted domain
A phishing campaign can arrive from a legitimate domain that was compromised only hours earlier. The message may pass basic reputation checks, use a familiar brand name and include technically valid DKIM or SPF records. A recent trust score increase can therefore create false confidence rather than prove that an email is safe.
This tactic is relevant to Australian households, businesses and public-sector suppliers. A fake invoice may imitate an Australian bank, an ATO notice or a myGov-related service, while a compromised domain belonging to a Melbourne retailer or Brisbane contractor can make the message look locally credible.
Use sender reputation as one signal in a broader investigation. Examine the message’s authentication results, links, language, timing and requested action before opening an attachment, changing payment details or entering credentials.
| Signal | Possible legitimate explanation | Phishing concern | Safer response |
|---|---|---|---|
| Trust score rose recently | Domain owner fixed abuse or restored a server | Attacker is exploiting a clean reputation window | Check history, headers and message context |
| SPF passes | Sending service is authorised | The domain itself may still be compromised | Verify DKIM, DMARC and the business independently |
| Familiar display name | Routine contact from a known organisation | Display name hides a different address | Inspect the complete From and Reply-To fields |
| Urgent payment request | Genuine deadline or account issue | Pressure prevents normal verification | Call a trusted number and pause payment |
Treat a sudden score increase as a clue
A trust score reflects observed signals at a point in time. If a domain’s score improves sharply after a period of poor activity, the change may indicate remediation, a new mail provider or simply a quiet interval. It does not establish that the current sender is trustworthy.
Attackers sometimes compromise an abandoned website, small business mailbox or cloud tenant and send a short campaign before the owner notices. A recently improved score can help the email pass automated screening, especially when the domain has a long registration history and valid DNS records.
Inspect the address beyond the display name
Expand the sender details and compare the visible address with the organisation’s normal domain. Watch for lookalike domains using swapped letters, extra subdomains, internationalised characters or a deceptive address such as accounts@brand.com.au.attacker.example. A genuine Australian business may use .com.au, but that ending alone is not proof of identity.
Check the Reply-To field as well. A message that appears to come from a supplier in Sydney but directs replies to a free mailbox or unrelated overseas domain deserves verification. Hover over links without clicking and compare the destination with the organisation’s known website.
Read authentication results carefully
SPF confirms that an IP address is authorised to send for a domain; it does not prove that the person using the mailbox is legitimate. DKIM shows that a message was signed by an aligned domain and was not altered in transit, yet a criminal controlling that domain can generate valid signatures.
DMARC alignment provides stronger context, but a compromised account can still send compliant messages. Review the full authentication results and the domains used for the visible From address, Return-Path and DKIM signature. An SPF fail checklist is useful when the sending infrastructure does not match the domain’s expected setup.
Look for compromise signals in the request
A stolen mailbox often produces messages that are nearly correct but slightly unusual. The sender may use an unfamiliar greeting, omit a normal signature, change invoice wording or refer to a conversation that never happened. Sudden requests to update bank details, buy gift cards, share Microsoft 365 credentials or bypass a standard approval process are high-risk indicators.
Inspect the timing too. A message sent at an unusual hour from an Australian supplier, especially one demanding same-day payment before a public holiday, should be checked through a separate channel. Do not use the phone number or link supplied in the suspicious email.
Verify the domain’s recent history
Review reputation changes, DNS records, registration details and known abuse reports rather than looking only at today’s result. A sharp rise following a compromise may occur because malicious traffic stopped, the domain changed providers or automated systems have not yet seen enough harmful activity.
A dedicated sender trust platform can help examine domain reputation, DKIM, DMARC and anti-spoofing signals. Bulk checking is useful for security teams reviewing suppliers, franchisees or a large Australian customer list, while an API can feed domain checks into mail gateways and payment workflows.
Use independent business verification
For a payment request, call the supplier using a number already stored in your accounting system or printed on a previous invoice. Confirm the account name and BSB through an established contact, not through the email thread. Australian organisations should apply the same discipline to requests appearing to involve the ATO, major banks, Australia Post or state services.
If the email claims to be from a colleague in Perth or a customer in Adelaide, contact that person through Teams, a known phone number or the organisation’s internal directory. Report suspicious messages to the relevant provider and preserve the original headers for the security team.
Respond safely after opening the message
If you clicked a link, close the page, do not enter further information and report the event promptly. Change exposed passwords from a clean device, enable multifactor authentication and review mailbox forwarding rules. Attackers commonly create hidden forwarding or filtering rules after taking over an account.
Organisations should quarantine related messages, search for the same sender across mailboxes and alert finance staff to possible invoice fraud. A recent improvement in domain trust can coexist with an active compromise, so reputation should support investigation rather than replace it.