100% agree. I got one last year from “Comcast” that looked totally legitimate. All the domains were correct. They managed to spoof everything, even the delivery header addresses. Everything but the sign in link, which went to a very obvious Russian redirect site.

Image