Final quiz — The Email Threat Landscape

BEC always involves ransomware encryptionA single successful BEC incident can move real money directly (e.g. a fraudulent wire transfer), with no malware or data-theft step in betweenBEC targets more victims than any other attack typeBEC is only a theoretical risk with no real recorded losses

They give up entirely – DMARC fully closes off BEC as an attack vectorThey register a lookalike domain and send from that insteadThey switch to attacking the domain's DKIM keys directlyThey wait for the DMARC record to expire

DMARC enforcement only applies during business hoursA lookalike domain is a separate, genuinely registered domain with its own valid SPF/DKIM/DMARC – DMARC only protects the domain it's published on, not domains that merely resemble itLookalike domains are technically illegal and get blocked automatically by registrarsDMARC enforcement is disabled whenever a lookalike domain is detected

Registering the exact same domain on a different TLDUsing a lowercase "l" or "rn" to visually mimic a different character in the real domain nameAdding a random subdomain in front of the real domainUsing the real domain's own MX records

Whether the message is technically allowed to claim its sender identityWhether the sending IP or domain has a history of sending abuse, independent of whether authentication passesWhether the DKIM key has been rotated recentlyWhether the domain has published a BIMI record

Blacklists only ever list domains that intentionally sent spamShared IP or hosting infrastructure can carry reputation bleed from a neighbor's bad behaviorBlacklisting is purely random and unrelated to any sending behaviorDNSBLs only check domains, never IP addresses

Reputation is dynamic – a domain clean today can be listed next week, sometimes from causes outside its own direct controlBlacklists are only updated once a yearA domain can never actually be removed from a blacklist once listedBlacklist checks are only relevant immediately after domain registration

It has no real downside – disposable addresses behave identically to real ones for a businessTrial abuse, signup-limit evasion, skewed lead-quality metrics, and no real contact to follow up with if something goes wrongIt only affects the disposable-email provider, never the business receiving the signupIt exclusively causes DKIM signature failures