{"success":true,"data":{"id":"bimi-on-lookalike-domain","label":"BIMI logo checkmark on lookalike phishing domain (brand impersonation via VMC certificate)","description":"BIMI (Brand Indicators for Message Identification) is a standard that allows email providers like Gmail to show a blue brand logo checkmark next to verified senders. Attackers register lookalike domains (paypa1.com, app1e.com, amaz0n.net) and obtain VMC (Verified Mark Certificates) so Gmail renders a trusted logo even though the domain is not the real brand. This signal fires when the Authentication-Results header contains bimi=pass AND the header.from domain in that result matches a known lookalike/typosquat pattern. Users who see the checkmark may trust the email unconditionally — making this a high-confidence phishing indicator. Score: +4.","tier":"danger","category":"sender","isThin":false}}