Comment by red_trumpet

If the attacker is in control of company.com, checking against this domain would not help.