DMARC Data Reveals More Than 900 Spoofed Emails Sent From Lookalike yyk.com Domain

Summary

DMARC data for yyk[.]com, a short domain resembling YKK, showed more than 900 spoofed emails in under a month. The account also received bounce notifications containing some rejected messages; a separate SPF audit found a typo authorizing unrelated servers.

Key points

• DMARC data showed more than 900 spoofed emails sent from yyk[.]com in less than a month.
• Some recipient security gateways blocked spoofed messages, but bounce notifications sent to the domain account included the full contents of rejected emails.
• The account also received legitimate messages intended for YKK because senders mistyped the domain.
• A separate SPF audit found a record exceeding the 10-lookup limit because it included sengrid[.]net, a misspelling of SendGrid that authorized unrelated servers.
• The article notes that low volumes of spoofed email can still pose risks, including targeted messages to an organization’s employees.