Pendell

I've got to admit, this one's pretty impressive, almost had me fooled for a hot second. No apparent typos, the formatting seems on point, and hey, it's actually coming from no-reply at microsoft dot com! That's a real email! Not "micorsoft" or something.

Though it is a little odd that Microsoft's advice is to "report the user" rather than "immediately change your password." But the true giveaway is that hovering over the "Report The User" button or the "click here" link yields a totally inconspicuous mailto: link that creates an email addressed to unusual.signin.activity at techconsulting-pay dot com... Now, I know big corporations love to use shady looking domain names, but that's a little much, even for Microsoft, now isn't it?

The best part is that these two mailto: links define your subject and body. If you click "Report The User", you will create an email as such:

To: unusual.signin.activity at techconsulting-pay dot com
cc: unusual.signin.activity at techconsulting-pay dot com
Subject: unusual sign-in activity
Body: Report The User

Yes, the subject line is genuinely uncapitalized and the body text consists entirely of the three capitalized words "Report The User." Now, if you click the button to change your notification preferences, you get a slightly different email:

To: unusual.signin.activity at techconsulting-pay dot com
cc: unusual.signin.activity at techconsulting-pay dot com
Subject: Unsubscribe+me

with an empty body field. Absolutely delightful.