It appears that Jarland Donnell via mailop <jarl...@mxroute.com> said: >Hey friends, > >Do me a favor and search your logs for this domain: >SIBBERTLLC.onmicrosoft.com
It's not just that subdomain. <whatever>.onmicrosoft.com is free throwaway accounts and I've seen the Docusign phish from lots of them. It's kind of clever, they send a real Docusign document to the onmicrosoft address which they then configure to forward to the actual victims (us). R's, John _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
