Safe Links
Safe Links is Microsoft Defender's URL rewriting in email, and phishing analysts need to decode such wrapped links to see the real destination.
How it works
Microsoft 365 replaces each link in a message with a safelinks.protection.outlook.com URL that carries the original address in a parameter; Proofpoint URL Defense and Mimecast do the same with their own formats.
Wrapping lets the gateway scan the target at click time, but it also hides where the link really goes, and attackers sometimes abuse open wrappers to make their links look trusted.
How to protect yourself
- Decode wrapped links offline to see the final domain before clicking.
- Remember that a wrapper only proves the message passed a gateway, not that the destination is safe.