Email Graph Analysis Detects Impersonated Suppliers When DKIM and SPF Pass
Security researchers have outlined a practical method to identify business email compromise attempts that bypass traditional authentication checks. The approach relies solely on metadata from mail server logs to build communication profiles between external and internal addresses. By tracking first contact, one-way traffic, dormant periods, unusual sending hours, and domain similarity, analysts can flag high-risk messages requesting payment changes. The technique works against mailbox takeover scenarios where attackers reuse legitimate threads and valid signatures. Implementation uses existing Postfix or Microsoft Exchange logs and requires no new infrastructure beyond daily exports. A simplified version focusing only on lookalike domain detection can be built in a single evening and still catches most supplier impersonation attempts.
HabrAug 26, 2026Translated from Russian