One Hyphen From Trusted: A Lookalike-Domain Vendor Impersonation That Beat the Eye and the Authentication Stack

An attacker registered near‑identical lookalike domains and used the exact display name of a known supplier contact to send authenticated phishing emails through a sales outreach tool; SPF, DKIM, and DMARC all passed (the lookalike domain's DMARC was p=none), allowing delivery. The body contained a displayed-link vs href mismatch that scanning flagged malicious, and the message was ultimately detected by relationship analysis comparing the sending domain to the supplier's known domain; IOCs include precision-bevelus.com, precisionbevelinc.com, and [email protected].