Aged-domain acquisition: The tradecraft phishing operators are using to bypass your mail filter’s reputation score

I’ve spent the past two years working on incident response and threat intelligence, and the pattern I’m about to describe is one I keep seeing show up in cases that should have been caught at the email gateway. The constant is that phishing-as-a-service operators are buying aged legitimate domains and redeploying them to steal credentials from enterprise and government targets. The most recent incident I worked involved a Sneaky2FA deployment r