New sign-in to your account
from security@harborline.example
MEDIUMunrequested_auth_emaillooks like a one-time sign-in code email with no matching recent user-initiated action on record
LOWatypical_pattern_known_senderknown sender, but this subject doesn't match any previously seen pattern from them
Verify your account now
from support@harborline-secure.example
HIGHsender_spoofdisplay name claims 'Harborline' but sending domain is 'harborline-secure.example', not 'harborline.example'
HIGHlookalike_domainsending domain 'harborline-secure.example' closely resembles watch-listed domain 'harborline.example' (84% similar)
HIGHauth_failureauthentication headers show SPF=fail, DKIM=fail, DMARC=fail
LOWnew_sender_sensitive_topicfirst-time sender writing about an account/security/payment topic
Update your payment details
from billing@n0rthgatecard.example
HIGHsender_spoofdisplay name claims 'Northgate' but sending domain is 'n0rthgatecard.example', not 'northgatecard.example'
HIGHlookalike_domainsending domain 'n0rthgatecard.example' closely resembles watch-listed domain 'northgatecard.example' (100% similar)
LOWnew_sender_sensitive_topicfirst-time sender writing about an account/security/payment topic
Urgent: wire transfer needed today
from alex.morgan.office@freemail.example
HIGHbec_patternurgent + payment-related language, from a sender never seen before
LOWnew_sender_sensitive_topicfirst-time sender writing about an account/security/payment topic
Invoice 4471 attached
from ap@vendor-invoices.example
LOWnew_sender_transactionalfirst-time sender for a transactional/shipping notice, not yet trusted
HIGHrisky_attachmentattachment 'invoice_4471.pdf.exe' has a suspicious double extension
You've been selected for a prize
from promo@luckydeals.example
MEDIUMauth_failureauthentication headers show DKIM=fail, DMARC=fail