{"success":true,"data":{"id":"google-infra-phishing","label":"Google infrastructure phishing — phishing content sent from legitimate Google domains (Forms, Docs, Sites abuse)","description":"Phishing emails sent FROM legitimate Google infrastructure (@google.com, @accounts.google.com, @forms.google.com, etc.) that contain phishing content in the body. Attackers abuse Google Forms, Docs sharing notifications, and Google Sites to send emails from real Google addresses that pass SPF/DKIM authentication. The phishing payload lives in the body — account verification demands, suspension threats, or links to non-Google domains. Score is +4 (lower than typical phishing) because the sender is genuinely Google.","tier":"danger","category":"phishing","isThin":false}}