Is a safelinks.protection.outlook.com link phishing?

Question

Received an email which contain the below hyperlink

https://nam02.safelinks.protection.outlook.com/?url=http*3A*2F*2Factuallysale.com*2F&data=02*7C01*7C*7C548d20ace3ec4747fe1008d7d7d8b597*7C84df9e7fe9f640afb435aaaaaaaaaaaa*7C1*7C0*7C637215198062448150&sdata=nk69pKQ7jIMsMVSfWVFG*2B38GuiK08jysbwN114W*2BMpM*3D&reserved=0__;JSUlJSUlJSUlJSUlJSU!!FZtbJVnXfw!gfgjegEG3qJawMzvsQm9QRhNrDiubzuVygOX_4wENNasy-WnA7vie2xl_WVQEUA0rg$

I checked the URL with urlscan.io and virustotal.com, but I could not find anything.

How can I know if this is phishing/malware or not? What do I look for?

Answer 1

Depending whether this is an organizational email or Outlook.com, it's one of the following:

• Office 365 Advanced Threat Protection ATP Safe Links.
• Advanced Outlook.com security for Office 365 subscribers

This replaces suspicious links in emails with https://*.safelinks.protection.outlook.com/* links. If a user clicks the link, it first goes to Microsoft's site that then evaluates whether it thinks the link is safe or not, and then passes the user to the original site or gives a warning. (How ATP Safe Links works.)

What "Safe Links" does is a totally bad practice for several reasons:

• It destroys URL visibility. Typically the user decides whether a link is safe or not by examining the URL as schroeder described in his answer. Following this method the user may believe that this is a URL from a trustworthy site outlook.com/ over a secure TLS connection https://. It's even expilicitly mentioned in the URL that it's a safe link and you are under a protection. But the link may be nothing but safe, and the protection may get its detection wrong, redirecting the user to a malicious site. This nullifies all the hard work put for educating the users on how they should handle suspicious URLs.

• It's easy to bypass. E.g. Cryptron Security's Security analysis of O365 ATP reveals that it's possible to bypass the ATP Safe Links by

  • Slightly modified <a x=">" href=" tags the ATP Safe Links isn't recognizing as links
  • Using <form action= " instead of links (or some other more clever HTML trick)
  • Showing different, harmless content to ATP servers (list of them is publicly available)
  • Using redirection services / URL shortener sites
    • https://www.google.com/url?sa=D&q=https://evil.example.com.

• Provides a false sense of security, making people click all links recklessly again.

• 5 Reasons Microsoft Safe Links Make Office 365 Less Safe adds that the protection is mainly blacklist based and can't handle 0-days / unknown URLs (although it's advertising Avanan's own products, it's a good article on this matter).

• Owen Nelson's The Problem With Microsoft's Safelinks adds the privacy problems: both Microsoft and the administrators of an Office 365 tenant can see the original URLs that may contain sensitive information.

• As these are not the direct URLs, urlscan.io & virustotal.com won't work for them.

Answer 2

Outlook web access rewrites all URLs to pass through its filter, so if you checked the entire URL all you got was "is outlook.com malicious?" and of course the answer is no. The link will redirect to "ht tp://actually sale.c om/" (remove the spaces to turn it back into a real URL). The * characters appear to be substitutes for the % character used to mark encoded URL parameters; not sure why they're doing that but I expect they had reasons. Additionally, there's some added URL parameters - the "data", "sdata", and "reserved" parameters - which appear to be part of the redirecting URL rather than they redirected-to URL. They were probably added by outlook.com for some reason, likely related to tracking data about user access to that URL (possibly even for purposes of URL reputation).

As for whether the linked-to site is malicious in some way: I don't know what the "actuallysale-dot-com" domain is for, but it does sound sketchy. That said, it's probably not anything worse than a scam site trying to sell you knockoff products as genuine, or something like that. The short URL without any way to identify who it was sent to makes it unlikely to be any sort of referral tracking service.

The site itself could certainly be a phishing site, but without visiting there's no way to know for sure and without the rest of the email I couldn't even hazard a guess. It could also be other sorts of malicious, such as mounting an attack on your browser (through rendering engine / JS runtime bugs), an attack on another site (via XSS, CSRF, clickjacking, or similar web security bugs), or even an in-browser cryptocurrency miner written in JS. It's probably not any of those, but I can't say for sure without checking, and that's going to be up to you.

For what it's worth, while "actuallysale dot com" is a real domain - IP address 198.105.254.23 - I don't see any "whois" info for it. Also, the fact that it's an HTTP link rather than HTTPS is sketchy; there's just not a lot of reasons to use HTTP for anything these days, and none at all for a legitimate site involving sales of anything.

Answer 3

URLs can be very difficult to interpret, but there's a trick that helps for most URLs:

1. Start from the very left where starts with https://
2. Then read to the right through each word/w0rd/word001 that is separated by . until you get to the first /. That first / is the key.
   • nam02.safelinks.protection.outlook.com
3. Then read back to the left to the last 2 or 3 words. That's the main website.
   • outlook.com
4. Don't be fooled by words before it that look can like websites
   • www.google.com.dvdr4g3.co <--- this does not go to Google

Once you start to see this, your brain will automatically look for that / and the real website domain.

Now that you know the website it goes to, now you can consider the context.

5. Start thinking about whether it makes sense that anyone would send such a link from this website, and if it makes sense for this person to send a link from this website

But as I said, this is not foolproof either. Some people use legitimate and well-known web services, like Google, to hide another website. And sometimes legitimate links can look like they come from another web site or service, like with mass email services (Mailchimp, etc.). But using the "does it make sense" test can help with a lot of those types of phishing links, too.

And despite all this, it can be very difficult to determine if a new website is phishing or not until you have experience with it.

And to top it all off, phishers are always looking for new ways to make tricky URLs. However, most do not, and do not need to. I have sent out simulated phishing emails with links to www.google.com.phishys.com and people still clicked because they thought it was google.

Answer 4

Personally, I think it is an organization's way of checking whether employees are still clicking on links in suspect emails. Our IT Security department has utilized similar tactics during "phishing and scam awareness campaigns" during the past decade or so. I have never heard of any 'consequences' for anybody who inadvertently clicked any such link. (disclaimer: this could all just be rumor and speculation, since IT Security never really tells us anything because it is all 'classified')