Link: Malformed subdomain ending in hyphen

Flags messages containing links whose subdomain ends in a dash, a construction that violates RFC 952 hostname standards and is often used to obscure the true destination domain or mimic a legitimate brand's naming convention. This technique appears in messages using business lures such as fake NDA addendums, confidential annexes, and missed voicemail notifications to drive recipients to attacker-controlled infrastructure disguised as trusted services.