What an attack looks like a week before it lands

An invoice-fraud email can look sudden to the person opening it. The infrastructure behind it may have been taking shape for days. A new domain, a certificate and mail records can leave warning signs while there's still time to block it.

This anonymised walkthrough is a composite sample, not a customer incident. Acme Payments is fictional. Its sample domain is acme-payments.example; the lookalike is acme-payrnents.example, where “rn” resembles “m”. All domains use the reserved .example suffix. The days illustrate one possible sequence, not a schedule every attacker follows.

Day 0: a lookalike domain is registered

Someone registers the lookalike of the supplier's domain. It resembles a name accounts payable already trusts. At this point there may be no website and no visible mail configuration. Registration alone does not establish malicious intent: legitimate organisations also register defensive domains and launch new services.

Security should compare the spelling with the supplier inventory, preserve the registration evidence and check whether the supplier owns it through a known contact. Record the domain as watching until there is enough context to act. AP should receive a short, factual heads-up if the resemblance is material: the domain is unverified, and it must not be accepted as a new supplier contact. Keep existing payment instructions unchanged.

Day 2: a TLS certificate is issued

A certificate appears for the lookalike. It can support an encrypted website, and certificate transparency records can make this change visible even before a useful page appears. A certificate is not an endorsement of the organisation behind a domain. It does not make a login page trustworthy.

Security should add the certificate and observation time to the case, check related hostnames and reassess the evidence with the supplier. If the domain is confirmed unauthorised, add it to the DNS filter under the organisation's blocking process. AP should avoid visiting it or forwarding it as a supplier resource. Use the established supplier portal instead.

Day 3: MX and SPF appear; the early-warning alert fires

The domain now publishes an MX record and an SPF policy. MX identifies mail-receiving infrastructure; SPF identifies hosts authorised to send for the domain. Together they indicate mail setup. They do not guarantee delivery, prove an email has been sent or show who controls the domain. Sending email does not technically require either record.

In this sample, the combined evidence triggers the VendorBreach early-warning alert here. The lookalike has moved from a parked name to staged infrastructure with mail configuration. This is the point to turn an observation into an owned response, rather than waiting for a fraudulent message.

Security should validate the finding, block the sender domain at the email gateway and confirm the DNS-filter entry. Search mail logs for earlier contact and retain the evidence. Notify the supplier through a known contact, not an address on the suspicious domain. Give AP the exact lookalike, the genuine supplier domain and a clear instruction: verify any bank-detail change by phone using a number already on file. The early-warning overview explains how these signals fit together.

Day 5: a copied login page goes live

The lookalike now hosts a page copied from the supplier's login screen. This adds stronger evidence of impersonation, especially when the supplier confirms it has no connection to the domain. A familiar logo and encrypted connection do not establish legitimacy.

Security should capture evidence safely without entering credentials, check whether anyone accessed the page and request takedown through the relevant registrar or hosting provider's abuse process. Keep local blocks in place while that request is reviewed; a takedown is not immediate or guaranteed. AP should use a saved, verified portal address and report any interaction with the copy. If credentials were entered, start the account-response process promptly. The vendor impersonation guide covers the distinction between a supplier's genuine domain and an attacker-controlled lookalike.

Days 6–10: the invoice-fraud email lands

In this illustrative sequence, the next step is a typical invoice-fraud message asking AP to pay an outstanding invoice into a new account. It may refer to a portal update or use the copied login page to support its story. This timing is an example, not a measured average or a deadline.

If the blocks are effective, the message is rejected or quarantined. Security should verify that outcome in gateway logs, check for variants and preserve the attempted message. AP should hold the requested payment change and call the supplier using the trusted number already in its records. Do not use a number in the suspicious email or an attached invoice. If money has moved, contact the bank and internal incident responders immediately.

The honest limits of early warning

Not every attack leaves setup work on the public internet. A compromised genuine mailbox, an existing domain or private infrastructure may offer no comparable lead time. Early warning catches the attacks that do leave visible setup, often days before the first email. It does not replace email security or the vendor's own controls. Public observations are evidence to assess, not certainty about a future attack.

Assign an owner to each alert, record blocking and supplier-contact decisions, and keep AP's verification process active even when nothing is flagged. Start with your supplier inventory and a free vendor risk check. The practical goal is to see the setup and act on warning signs, without treating silence as proof of safety.