[mbreese]

That’s really important to add to the story! I think that makes the rest of the story more troubling. Especially knowing that domains unrelated to the apparent user phishing code were affected.

You might think of adding it to the post-mortem doc so that others don’t assume what I did.