"The domain is the ID" holds, with one wrinkle worth spelling out: for the 30 to 40% of cases on *.onmicrosoft.com, there's nothing to look up. No registration date, no registrar, just a tenant name. Those are where the allow-listing fix does the work.

The other half, the paid .top and .com domains, are where registration data earns its keep. A "helpdesk365"-style name registered last week is about as loud a signal as you get. One low-effort way to catch them before they message anyone is to filter a newly registered domains list for words like helpdesk, itsupport or 365 and alert on hits. WhoisFreaks (I work on it) publishes a free daily list on GitHub. It's a partial 10k/day sample, so a hit is a real signal and a miss proves nothing.