An ISP DKIM-Signed This Brand Impersonation

A high-severity phishing campaign impersonated a major UK high-street pharmacy by sending a survey lure to a fresh-produce wholesaler; the message legitimately passed SPF/DKIM/DMARC because it originated from a consumer ISP mailbox and was DKIM-signed by that ISP, enabling alignment-based checks to succeed. The landing page hosted a pixel-perfect replica storefront (served from an S3 URL) with an embedded survey modal and stale seasonal merchandising that revealed the page was a copied replica; indicators include the S3 URL, the rewards-style sender local-part on an unrelated ISP domain, and headers showing dmarc=pass and compauth=pass. The incident highlights how domain alignment validates only domain authorization, not authorship, and how allow-listing or mail-flow rules (SCL:-1, SFV:SKN) can cause dangerous messages to bypass filtering.