A domain looked almost right—and that was the problem.

Softfusion identified domains registered to resemble a customer’s legitimate domain. Small changes in spelling or structure can be easy to overlook in a busy inbox.

A registration alone does not prove that fraud has occurred. It does create an opportunity for impersonation, misleading email, fake sign-in pages, or payment-change requests.

The useful moment is before an employee assumes that a familiar display name or nearly correct address is genuine.

• Reviewed the suspicious registrations and how closely they resembled the legitimate business identity.
• Considered how the domains could be used in email or web impersonation.
• Communicated the risk without representing registration alone as proof of an active attack.
• Reinforced independent verification for payment, banking, credential, and urgent access requests.
• Connected domain awareness to email protection, identity controls, and employee reporting.

Impersonation succeeds by fitting into an ordinary workflow. Technical controls matter, but so do verification procedures that give employees permission to slow down a sensitive request.

The broader lesson is to monitor the business identity outside its own network and connect findings to practical decisions inside the organization.