http://e26whn2524322mkxb3cbyk27ev2ihhq2biz35hty7gzgsyrwrygq27yd.onion/posts/blog/security/misuing-microsoft-defender-for-cloud-apps-to-bypass-outlink-protections.html
In late December, I sat down (with my coffee), opened the dashboard and saw that a request had been logged with a strange Referer: The referring domain begins with my domain name, but has additional labels appended (i.e. bentasker.co.uk.example.com rather than bentasker.co.uk ). The redacted portion of the name does not contain a domain that's immediately recognisable, although it does use a TLD which makes you think of Microsoft.