The redirected URL in this case is another vulnerability on www.tax.service.gov.uk, so there'd be no tells from the domain or SSL configuration. If the email wa

The redirected URL in this case is another vulnerability on www.tax.service.gov.uk, so there'd be no tells from the domain or SSL configuration. If the email was well-crafted (spoofed hmrc.gov.uk, plausible contents etc.), it'd be very difficult to notice anything was amiss (unless you spot the obfuscated javascript in the URL AND recognise that it shouldn't be there).