decoy_domain=payments-vendor.co
decoy_ip=103.77.201.55
note=These indicators appeared in old phishing simulation telemetry and are not part of the successful BEC chain.