A colleague in my Federal agency received what LOOKS like a fairly primitive phishing e-mail (bad grammar, typical "your account is locked" scenario, etc.) where the phishing link is:
2892315232e342469ddd8529ecaed302.svc.dynamics[.]com/t/r/j0E6fiLhB7S4xTp0ybo43HjtIBvAo-7uG5kVQL5Cbvg#e___.webmaster@___.gov:489944848849949930-3993=3-00399e883930wwwwwww (Square brackets added to prevent accidental clicking, and underscores anonymize the recipient.)
From what I can tell (not actually being a Dynamics user), "svc.dynamics.com" is a legitimate, non-malicious domain. But I'm wondering if the behavior of Dynamics (or Svc.Dynamics) is such that a malicious actor can use this type of apparently legitimate link to redirect a "clicker" to a malicious destination?
Thanks.
Randy Steer.
