Phishing scammers are bypassing Google's DKIM authentication by using Google Sites to send fake "subpoena alerts" that appear to come from "[email protected]." The scam creates authentic-looking emails by entering email text as an app name, which Google automatically sends and then links directly to sites.google.com instead of accounts.google.com to steal credentials.

Full Article and Alert informaton can be found HERE!!