The Domain Registered This Morning: How a Compromised University Account Exploited Email Security's Zero-Day Blind Spot

On March 30, 2026 a phishing email from a compromised student account at Kazan National Research Technical University targeted a Virginia K-12 school district; the message used a thread-hijack subject and legitimate institutional footer while containing a same-day-registered randomized domain (ddorrgkgtv.com) on nonstandard port 8443 to evade URL reputation scanners—IRONSCALES quarantined the message using domain registration intelligence, display-name impersonation history, and community behavioral signals.