A real Carnival booking confirmation passed SPF, DKIM and DMARC while one link served customers malware. The lapsed domain behind it, and what it delivered.