Is this email a spam or wrong security practice?

[Miro]

Got officially looking email from isc2.org. And yes, my annual fee is due soon

All the links in that email, even the ones saying ISC2 have a "foreign" domain linked to it - "https://cl.s12.exct.net/?qs=9794952c7..."

I just checked the certificate and it's issued to SalesForce

As I did not click on any of links, this is either a really well disguised phishing email, or a blatantly wrong practice by ISC^2 and goes against some of key anti-phishing tenants we try to teach others to apply

[Roels]

Exactly my thoughts also when receiving a similar e-mail today.. interesting also that there's no response at all from ICS2 in this member-support thread?

cheers,

Roel.

[InfoSecAddicted]

Dear ISC2 Team,

Today I received an email which raised significant security concerns. The included link: https://cl.s12.exct.net/?qs=545...

1. Was blocked by my local malware detection system
2. Was blocked by my DNS-based anti-malware and spam filter
3. Returned multiple suspicious results during a manual domain check

Given ISC2’s role as a leading security organization and the membership fees you collect, it is reasonable to expect that your communication infrastructure adheres to strong security practices. Specifically:

1. Emails should clearly originate from an @isc2.org sender domain.
2. Embedded links should be fully transparent, without tracking components, and should clearly resolve to a .isc2.org domain.

If your current email or application provider cannot meet these requirements, I strongly encourage you to reassess the service.

As a security community, we must lead by example and ensure that our communications reflect the standards we promote.

Best regards.

[Roels]

A year has passed and still the same practice is used also without any response back from ISC2..

[mariatirado]

Hi @Roels - our CX team is currently reviewing your case, and you should be hearing back from them today. Thank you for your patience. 

[Roels]

Hi @mariatirado ,

I haven't heard anything back (surprise?).

Can someone from ISC2 please at least confirm they understand the issue as well described by @InfoSecAddicted in this thread and propose solutions how it will be solved?

thanks

Roels.

[mariatirado]

Hi @Roels, thanks for following up and for raising your concerns. Our Customer Experience team has reached out to @InfoSecAddicted directly and is actively working to resolve the issue. We appreciate your engagement as we work through this together!

[Mrankdnkm]

I am also receiving emails from this domain.
Is this a real isc domain or not?
Very simple question !!!