We’re now seeing phishing emails being sent from the @post-xero.com domain.  The full From address is messaging-service@post-xero.com, rather than Xero’s legitimate messaging-service@post.xero.com address.  We’ve started the process to get the @post-xero.com domain taken down.