Comment Re:It's almost 2026 (Score 1) 35
few people will ever be able to tell, which domain is held by Microsoft or some other malicious entity.
A query of domain against the WHOIS service generally answers the question. If the registrar is MarkMonitor, then you can guarantee the legitimate registrant is at least an enterprise if not Microsoft.
This is nice for us to know, but Joe Shmoe Microsoft user will not be able to make that determination and can, unfortunately, not rely on amateur level sanity checks "the message comes from microsoft.com, so it's probably legit". This is what we teach our friends and relatives "no, USPS/DHL/UPS won't contact you from an delewareflowers.com domain". And Microsoft actively destroys this one bit of helpful information through their pathetic domain name setup.
Due to the legitimate entity failing to keep up to date all SMTP security requirements, etc, such as NS records, DMARC, SPF management records, for all domains.
Or for that matter failure to manage what URL endpoints may exist behind every domain; allowing for exposures by way of some obscure outdated URL endpoint allowing an Arbitrary redirect or HTML content return. Such as the old https://example.com/?content=X... returns a document with exactly raw content XYZ; vulnerability.
We wouldn't need any of these, at least in this case here, if the link contained therein pointed to a domain, which even imbeciles could positively identify as legit. No, get[dot]activate[dot]win" does not fit into this category.