The warning I got from IT (when they blocked my internet access temporarily was that
"activities that indicates laterral movement from this host DK-20277789.company.net using your account
to LAP-F2B84M3 SE-3N8YWM2.company.net SE-37X8134.company.net LAP-2XY9RT3 SE-D7NP232.company.net SE-17X7034.company.net.
So, I guess the $domain variable should be used with care?