Microsoft has paid customers, which send emails via Microsoft Azure hosts. So they're specifically allowlisted and are bypassing Microsoft O365 filters. Same f

Microsoft has paid customers, which send emails via Microsoft Azure hosts. So they're specifically allowlisted and are bypassing Microsoft O365 filters. Same for Google Business customers. Phishers pay to send the emails. You don't pay to receive no email. So that's the conflict of interest of these businesses. The "CA" for email is basically SPF/DKIM/DMARC as extensions but they're kind of useless because all email providers are lying about quarantine mechanisms anyways. Nothing happens if you report an abuse of spam policies. But I'm kind of biased because I maintain my own antispam repository [1]. Most of the professional phishing campaigns use e.g. cloned websites under a different top level domain (like company-global.com or company-eu.com), with even legit looking profiles on LinkedIn which are even LLM controlled in their responses. They use pictures and sometimes even identities of real people, and the humans usually don't know about anything that's happening online with their identity in their name. [1] https://github.com/cookiengineer/antispam https://github.com/cookiengineer/antispam