Our domain name incliudes 'lli' in the middle. Scammer registered a domain with 'lll' in it.
The most convincing one I've seen so far was an email that looked like a normal Exchange online synchronisation failure report that when youclicked through took you to a copy of the Office365 login process