Microsoft 365 'Outage Notification' e-mails sent through SendGrid from re-purposed old domains, landing behind a decoy-blog cloaker

E-mails styled as Microsoft 365 service-health notices, with subjects such as 'Outage - <six-character code>', sender names ending in 'Outage Notification' or 'Service Health' and a reference to an Exchange Online incident number, sent to organisations in the United States from 12 November 2026. Each recipient gets a personal SendGrid click-tracking link on a branded host of the sending domain (for example url2830.planetmaison[.]com or url7489.newbooker[.]com), which forwards to reallifeaccounting[.]com. The sending domains are long-registered names that changed hands shortly before use: between 3 and 12 November each was moved to new name servers and given its own SendGrid sender authentication and the same mail-forwarding setup, with no website: moments-notice[.]com, planetmaison[.]com, newbooker[.]com, cityofbernie[.]com, kioskcom[.]com, batobin[.]com, scchapman[.]com, networkformer[.]com, socialistappeal[.]org, fantastika[.]org, cat315[.]com, ocmarketplace[.]com, downmode[.]com, mysuccessfulfuture[.]com, flyingbiscuitcafeatlanta[.]com, sheincustomerservice[.]com, cojesc[.]net, enjoyhsu[.]com and tongwork[.]com. The landing domain, also a long-registered name re-pointed on 10 November, shows a visitor it does not want, such as a scanner or a sandbox, a generated decoy blog instead of the lure: a made-up magazine name, stock photos, filler articles named themelist0.html, themelist1.html and so on, a phone-number form, and a small script that reports back whether the visitor runs JavaScript. The same decoy generator also fronted an OpenSea look-alike, 0pensea-lo.shared-smart[.]com, in early November.