A law firm catches a lookalike domain impersonating a partner and has it taken down, with its DMARC policy already at reject

A firm can have every email control in place and still be impersonated. DMARC at p=reject tells receiving servers to refuse mail that claims to come from the firm's own domain, and it works. It says nothing about a different domain that merely looks the same, registered for a few dollars by someone who knows that a partner's name, a real matter and a wire deadline together are persuasive. For a law firm with a real-estate practice, closing weeks are when clients are most ready to follow a payment instruction, and most likely to act on one that appears to come from their lawyer.

Detection came from outside the mailbox. The firm's domain monitoring watches certificate transparency logs, because an attacker who wants a working website or secure mail usually obtains a certificate, and it compares new registrations against the firm's names with rules for one-letter changes, swapped characters and look-alike glyphs. The monitoring flagged the new domain within hours of its certificate. The gateway also flagged first-time senders whose display name matched a partner but whose domain was not the firm's, which is how the first message was recognized.

Before reporting anything, the team captured the evidence: screenshots, registration data from RDAP, the full message headers, the certificate and the hosting address, each with a time. Then two abuse reports went out, one to the registrar and one to the hosting provider, each stating plainly what the domain was doing. Registrars and hosts generally act faster on clear evidence of phishing and fraud than on a trademark argument. The firm's counsel reviewed the Uniform Domain-Name Dispute-Resolution Policy, which lets a trademark owner ask for a transfer or cancellation when a domain is confusingly similar, the registrant has no legitimate interest and the registration and use were in bad faith. The complaint was drafted and held back as the slower route, which can take weeks.

The client warning was short and specific. It named the lookalike domain, said the firm had not sent the message and repeated the firm's rule: wire instructions are given only by a call to a number the client already has. The same warning was sent to every client with an open closing. The firm blocked the domain in its own gateway, reported the incident to the FBI's Internet Crime Complaint Center and kept the finance contacts at each client on file for next time.

In this illustrative case the timings are modeled. Takedown speed depends on the provider, and an attacker can register another domain the next day, so the monitoring continues and the rule that protects clients is the callback, not the takedown. This engagement is illustrative, and nothing here is legal advice.