A coordinated crackdown on RaccoonO365 reveals the scale of phishing-as-a-service operations, as domain and DNS data expose hundreds of linked artifacts and offer a window into the infrastructure of low-skill cybercrime.