Scam Email Case Study: Nine Burner Domains, One Operator, and the Registrars Who Pulled the Plug

A Pennsylvania diner was getting polite cold emails from six seemingly unrelated businesses. Reading the original messages together linked nine disposable domains to one operator. Registrar reports took four domains offline, but the sender had reserves, and the investigation is still ongoing.

The Emails That Looked Unrelated

One of the businesses I look after is a family-owned diner in eastern Pennsylvania. Their public contact address forwards to a mailbox I keep an eye on, and over the summer of 2026 it started collecting a particular kind of email. It wasn’t spam in the usual sense though as each message was short and polite, had the diner’s name in the subject line, and came from what looked like a different small company with a reasonable reason to write.

In early August a packaging supplier offered custom branded cups; a few weeks later someone who had “noticed your one-star reviews” offered to help; then came a family entertainment booking agent and a business broker’s client who was a “serious buyer” and wondered if the owners had thought about selling; a corporate events planner asked about catering and ended up pitching advertising inside ChatGPT; in mid-September an insurance agent wrote with a question about the diner’s commercial coverage and followed up twice.

A restaurant owner reading these between lunch and dinner would see six unrelated cold pitches and most would go unanswered, but sooner or later one would land on a day when the cups really did need reordering, or the reviews really were bothering someone, and maybe a reply would go out. If/when it does, the conversation goes wherever the sender wants it: a deposit, an invoice, a fee to make bad reviews disappear, or the details of an insurance policy.

Anyway, I suspected the emails weren’t unrelated so I saved the full original of each message (headers included) and read them side by side.

Six Companies, One Sender

The parts of an email a reader sees (ie the sender’s name, the signature and the logo, etc) are typed by whoever sends it. The headers though are written by the mail servers the message passes through and they’re much harder to fake. Laid next to each other the headers of these emails told one consistent story.

I started with the sending domains. In public registry records, every one of them had been registered within roughly fourteen months (most only weeks or months before its first email to the diner), they were spread across a few low-cost registrars, all used Cloudflare for DNS, and all had their ownership hidden behind privacy services. Most had never hosted a website and existed only to send mail. An established cup supplier or insurance agency doesn’t write to you from a domain bought six weeks ago with nothing on it.

Several of the domains were also built to borrow a real company’s name. The cup supplier wrote from a domain one letter off from a genuine promotional-products company…the catering inquiry was dressed up as a real marketing agency and offered that agency’s actual ChatGPT ads service…the buyer’s domain echoed a real business brokerage…the insurance emails were signed with the name of a real, licensed agent at a real independent agency in Pennsylvania, from a lookalike domain the agency doesn’t own. I found the agent’s photo and bio on his employer’s own website.

The clearest evidence though was in how the mail was sent. Five of the domains each had a Microsoft 365 account of their own and signed their mail exactly the way a newly set-up Microsoft 365 account does by default. Paying for a separate business email account for every throwaway domain sounds wasteful until you see what it buys: messages that pass every authentication check and arrive in the inbox from Microsoft’s own servers.

The other four went out through Gmail but they didn’t start there; the headers showed each one handed to Google from rented servers. One was a virtual server whose hostname described it as a “sender”, another was a budget server at a different host, and for the insurance domain a fresh Amazon cloud server in Canada was used for each individual message. On one of them, the server’s name matched the random ID of the email it sent which is what an automated mailing script leaves behind when it starts a machine, sends one message and shuts it down. A small-business owner asking about catering doesn’t do that but software built to send a lot of mail without leaving a trail? Yes indeed.

So this was one operation working one target: a shelf of disposable domains, two sending setups, and a rotating cast of fake people all pointed at one diner’s inbox.

Going After the Domains

Blocking the senders would have cleaned up the diner’s inbox for a week or two…until the next domain came along. The better lever is the registrar the domain was bought from because registrars have abuse policies and when one finds a domain being used for fraud or impersonation it can put the domain on what’s called clientHold. That takes the domain out of the internet’s address book so its mail records disappear with it and even if the email account behind it still exists, receiving servers can no longer verify mail from it so the domain can’t send anything that will arrive. It’s the closest thing to a takedown that exists for a domain like this.

Most of the domains were at one registrar and my first detailed report to it went by email. A reply came back saying it no longer accepts abuse reports by email, only through its web form. So I filed again (one form submission per domain, tedious), each with the original email file attached so the reviewers could read the headers for themselves rather than take my word for them.

One of those submissions was rejected automatically for not meeting the registrar’s “required evidence standard.” The evidence was the same quality as the rest though; turns out the trouble was the category as I’d filed it as phishing which requires naming the brand being imitated, and that particular persona didn’t imitate anyone, so I’d entered “N/A.” So I re-sorted the reports: phishing where a real company was being impersonated and I could name it and spam where the persona was invented. For the review-removal pitch I added that the FTC banned paid suppression of reviews in 2024 which gave the reviewer a legal reason to act and not only a complaint about unwanted mail.

The insurance domain was at a different registrar which openly said it may not act on spam alone so I filed that one as impersonation (which it was) and included a link to the real agent’s page on his employer’s site. I also wrote to the real agency, to the agent himself and to their general inbox, to tell them someone was writing to local businesses in his name and to suggest they complain to the registrar as well. The business being impersonated usually carries more weight with a registrar than a bystander does. And then one more domain was at a third registrar where an emailed report was the only option.

What Happened

The two cup-supplier domains were on hold the day after I filed and the registrar closed both reports as “registrar action.” The domain that followed up on the review pitch went down the next day. The insurance domain was on hold a little over two weeks after I reported it (but nobody wrote to tell me, I found out from the registry records which is why I check those on a schedule instead of waiting for a reply).

But then the cup supplier came back! Three weeks after its first two domains were suspended, the same persona with the same pitch wrote again from a third lookalike domain. Registry records showed that domain had been registered the previous December, months before the first two were suspended. It had been bought ahead of time and kept in reserve for exactly this.

I reported it but unfortunately the registrar that had already suspended this sender twice closed the report as “insufficient evidence for action,” with no explanation. The sender wrote again two days later so I filed a second report that cited both earlier decisions by their report numbers and attached the new email…it’s still open.

As of early November, four of the nine domains are suspended and five are still running. Three of the five have been triaged by the registrar and are waiting on a human reviewer, and the third registrar never replied. I’m not going to round that up to a win. Shutting down four domains (including the two most direct impersonations of real businesses) cost the operator real infrastructure and forced them to fall back on the reserves, but unfortunately the rest of the operation is still sending.

What the Case Shows

Each of these emails was written to read as if a person had looked the diner up and had a reason to get in touch. Nothing in the message itself gave that away and none of them would have tripped an ordinary spam filter because the mail was properly authenticated and sent through Microsoft and Google. What gave it away was everything around the message: how new the domains were, how alike they were, the brand names they borrowed, and the rented servers they were sent from. You see that only by keeping the original emails and reading the headers and in this case only by reading them together because each email on its own looked innocent.

The same goes for the response. A filter moves the problem into a folder and leaves the operator free to work through the rest of its list but a suspension at the registrar stops the domain for every business it was going to write to next. Getting there takes knowing which registrar runs which process, what each one counts as evidence, and when a rejection is a wrong category rather than a weak case and then it takes checking back until the record changes.

That’s the work I do for the businesses whose websites and email I manage, and I’m still doing it for the diner. Every new lookalike that turns up goes through the same steps: headers, registration records, the real business being borrowed, and a report to the registrar in the form it actually accepts.

If your business has been getting oddly friendly email from companies you’ve never heard of, get in touch.