Best of the Worst: Five Attacks That Looked Broken (and Worked)

This Threat Intelligence roundup reviews five real phishing attacks that, despite poor quality control (typosquatted domains, unpopulated template variables, deceptive URL substrings, encoding errors, and inconsistent branding), successfully landed in recipients' inboxes; the post explains how authentication signals like DKIM can be misleading, how allowlists and naive URL parsing enable delivery, and provides concrete defender takeaways including auditing transport rules, detecting kit tells, validating eTLD+1, and pairing DKIM with brand-impersonation detection.