>Legit password resets for example come from more random top level domains with "microsoft" in it, like microsoftonline.com

Or aka.ms