build1 publisher
A lapsed Carnival promo domain routed authenticated booking mail into a cloaked malware network
A genuine Carnival booking confirmation passed SPF, DKIM and DMARC and pointed at a promotional domain the company had let lapse. Someone re-registered it, wired it into a cloaking network, and the link kept routing for 74 days.
Publishers:dev.to
Reality
- Evidence62
- Adoption42
- Hype gap−12
- Incentives30
- Confidence57