Analytics BIOC Informational
✕

Display text URL differs from actual URL

An email contains a hyperlink whose display text shows a URL different from the actual destination URL.

Module:
Email Security
Licensed by:
Email Security
Data source:
Microsoft 365 Emails
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Malicious URLs
Attacker's goals:

Deceive recipients into trusting a visible URL while redirecting them to a different destination, often for phishing, credential harvesting, or malware delivery.

Investigative actions:

Review the display text URL and the actual destination URL. Verify the reputation and legitimacy of the destination domain. Check whether the sender or domain is known or trusted within the organization.

Test period:
N/A (single event)
Deduplication:
1 Hour 30 Minutes