It is not uncommon for organisations to receive emails containing suspicious links. Spambrella’s URL Defense feature is powered by Proofpoint Targeted Attack Protection (TAP). It automatically rewrites and evaluates links in email, using threat intelligence and real-time sandboxing to identify destinations that may be hazardous to your people, devices or data.
URL Defense checks links against Proofpoint’s continuously updated threat intelligence. When a destination is not already known, TAP can analyse it at the time of click. This adds protection against changing phishing campaigns and malicious websites that may not have been dangerous when the original message was delivered.
How does URL Defense work?
URL Defense is activated automatically and does not require users to manually submit incoming messages for analysis. It rewrites links found in protected email and checks the destination when the link is opened.
The rewriting process is immediate. When you select a protected link, Proofpoint’s security filters inspect the destination before allowing access. If the destination is considered safe, you continue to the intended website. If a threat is detected, access is blocked and a warning is displayed.
Does URL Defense change the content of emails?
URL Defense does not change the visible wording or intended content of an email. It rewrites the underlying destination of links so they can be checked safely. In plain-text emails, or when inspecting a link directly, a rewritten address can usually be identified because it begins with https://urldefense.proofpoint.com.
The URL Defense Decoder reverses that rewriting process and displays the original destination. This can help administrators investigate a link, confirm where it points, or provide the original URL when troubleshooting.
Important: Decoding a protected URL does not make its destination safe. If TAP has blocked a page as hazardous, visiting the decoded address may compromise your device, network or data. Only continue when you understand and accept the risk.
How to use the Proofpoint URL Defense Decoder
You can retrieve the original destination from a rewritten URL in three steps:
- Copy the complete encoded link beginning with
https://urldefense.proofpoint.com. - Paste the link into the protected URL field below.
- Select Decode URL to display the original destination.
TAP checks links against a continuously expanding database of malicious destinations, but a legitimate website may occasionally be classified as suspicious. If you believe a safe destination has been blocked incorrectly, decode it for investigation and contact Spambrella support with the relevant details so the classification can be reviewed.
For Proofpoint Enterprise and Proofpoint Essentials licensing or renewals, contact Spambrella.
