A company employee gets an email: 'Hi Sarah, this is Mike from IT. We noticed unusual activity on your account. Please click this link and log in urgently to prevent your account from being locked. — IT Support.' The email address is '[email protected]' (the real domain is company.com). Sarah is about to click it. As a security detective, what attack is this, what red flags do you see, and what should Sarah do?