A Carrier-Registry Phish With a Browser's CSS Pasted In

**Phishing campaign report:** A targeted phishing message impersonating the Federal Motor Carrier Safety Administration delivered a single call-to-action link to a lookalike registry hosted on attacker-controlled subdomains, seeking carrier identity and fuel-tax payment details. The lure passed SPF/DKIM/DMARC from the attacker-owned domain, contained HTML residue (browser computed-style and a foreign renderer class `ds-markdown-paragraph`) indicating copy-paste composition, and includes IOCs and a recommended content-side hunt for rendering-residue indicators.