A finance clerk received an email appearing to come from the CEO requesting an urgent wire transfer to a new vendor. The clerk forwards it to the SOC. Reviewing the mail gateway logs, an analyst notes the message passed SPF, DKIM, and DMARC checks and originated from a legitimately registered external domain, 'compañy-corp.com', while the organization's real domain is 'company-corp.com'. There were no malicious attachments or links. Which indicator best characterizes this activity?