DoppelBrand: BEC lookalike ServiceNow domain observed in MAIL FROM or Reply-To

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•2

Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.