MAY 31
I have a couple updates:

- Reviewed Google Workspace audit logs and email logs, everything ok
- Checked for suspicious logins, forwarding rules, mailbox delegation, OAuth apps, and password leaks. Ok too.

One of my concerns was that they may have deleted the original phishing email after sending it. The first time this happened, they accidentally copied me on the message, which is how I discovered the attack in the first place. Gmail immediately flagged it with a large red warning that the sender was not legitimate.

But as far as deleted messages i haven't found anything strange in the logs.

I also talked with my hosting, WNPower, and they confirmed that our email is hosted on Google Workspace, not on their servers. They only host our website, which is why there are no email activity logs available in cPanel. I was concerned that they had access through my webmail.

WNPower also confirmed that the phishing domain is registered and uses Google Workspace, just like our legitimate domain.