Comment by walth

Never attribute to malice that which can be explained by stupidity.

We had the same thing happen with any email with 2f<domain> anywhere in the message body on Google workspace

The "2F" URL decodes to slash / and a third party registered our 2f<company>.com (probably for nefarious purposes)

That kicked on the automatic filtering on messages that had URL encoded links and started blocking them.

Eventually, we had to register 2fgoogle.com ourselves to escalate the issue.