It appears that Jarland Donnell via mailop <[email protected]> said: >Hey friends, > >Do me a favor and search your logs for this domain: >SIBBERTLLC.onmicrosoft.com
It's not just that subdomain. <whatever>.onmicrosoft.com is free throwaway accounts and I've seen the Docusign phish from lots of them. It's kind of clever, they send a real Docusign document to the onmicrosoft address which they then configure to forward to the actual victims (us). R's, John _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
