--- title: Suspicious indicators description: Look-alike addresses and probing under watch, what is open and what is closed. icon: Search verified: 2026-08-19 --- A living list, edited in place as entries open and close. Observations come from [Track Delivery](/docs/it/email/track-delivery) and from DNS, 14 to 17 August 2026. The company is visibly targeted on its finance and trade axis: spoofed bank mail, look-alike freemail addresses. Most entries below need an answer from a human inside the company before they can be closed. ## The standing rule Any address shaped like `something.advmfr@gmail.com` or `advmfr.something@gmail.com` appearing in a business thread is reported **before** anyone replies to it, whitelists it, or wires money based on it. That rule exists because of entry 1, and it is now part of the alert triggers in [Quarantine watch](/docs/it/email/quarantine-watch). ## 1. `export.advmfr@gmail.com`: closed 19 August, legitimate A Gmail address mimicking the company mailbox `export@advmfr.net`, following the pattern `.advmfr@gmail.com`, copied on customs and shipping correspondence. **Verdict: the export team owns it.** No compromise, no fraud attempt. The copying was deliberate. That closes the alert, not the matter. Export paperwork: invoices, shipment values, clearance documents, keeps flowing through a personal Gmail mailbox that the company does not control. Whoever holds that password holds the export paper trail, and the company has no way to revoke it, audit it, or recover it if the account is lost. Two ways out, and the choice belongs to the export team: - stop the copying, or - replace it with an archive the company actually controls. **What this entry cost, and why it stays here.** Establishing that the address was legitimate took reading a Sent folder, a delivery log, and a DNS record. That is the price of a company mailbox having a freemail twin: and it will be paid again at the next alert, by whoever forgets this page exists. Worse, staff grow used to seeing that twin in their threads. That habit is precisely the reflex a real attacker needs: the next `something.advmfr@gmail.com` to appear will look just as ordinary. Which is why the standing rule above outlives this closure. ## 2. `narinsoda33@gmail.com`: medium Inbound on 17 August at 10:31 to `account@advmfr.net`, a mailbox that does not exist, so it was rejected. A look-alike of a real person's name on freemail, aimed at an accounting-style address: the same trick as entry 1, this time inbound. **Open question:** is this Gmail his? If not, the address is flagged to the team explicitly, because mail from "Narin" at a Gmail address is exactly what staff would trust. ## 3. `kasikornbank.com` traffic: closed 17 August, legitimate Initially suspected of spoof probing: `tradefinance@kasikornbank.com` writing repeatedly to a nonexistent `ACCOUNT@advmfr.net`. **Verdict after header and mailbox verification:** legitimate. The `chanhom@` mailbox holds 97 genuine KBank messages: credit advices, payment copies, daily K-eDocument reports, all addressed to the company by name. Kasikornbank publishes DMARC `p=reject` with strict SPF, which makes exact-domain spoofing hard. The `ACCOUNT@` traffic is almost certainly a stale address in the bank's own records, and the rejections are harmless. Two standing rules survive this closure: - **Never whitelist a bank domain.** - Any Kasikornbank mail requesting an action: a payment change, an urgent transfer , is verified out of band. Look-alike domains such as `kasikornbank-secure.com` remain the real threat. ## 4. Probing of nonexistent finance aliases: low Steady inbound to `account@`, `ACCOUNT@`, `it@` and `advance@`: none of which exist: from rotating senders: DHL billing, invoice addresses, a misspelt `regencyhoildays.com`, Google bounce addresses. Attackers are mapping the company's likely finance addresses. The rejections are fine and no action is needed, but the pattern confirms the targeting. **Consequence:** do not create these aliases. If one ever becomes necessary, expect spam from the first day.