What is Proofpoint URL Defense?

Body

Overview

Why are all of the links in email pointing to the https://urldefense.com/ domain? This article provides an overview of Proofpoint URL Defense.

At any time you can report an email to OIT Security for analysis using the guide at How to report a spam or phishing message?.

 

What is Proofpoint URL Defense?

Proofpoint URL Defense protects against malicious email links. When an email is received, URL Defense rewrites all links in the message to redirect to the Proofpoint email filter. If you click a rewritten link, your browser is sent to Proofpoint first which only allows your browser to visit the original website if it is not categorized as malicious. A malicious website can still go undetected and a rewritten link could lead to a malicious website. Please exercise caution when clicking links in email, especially from unknown sources.

Re-written links start with https://urldefense.com/.  The visible link text is not changed, however, if you hover your mouse over the link you can see the re-written link, as shown below in Outlook:

Outlook message with the mouse hovering over a link, showing the rewritten urldefense.com address

In Outlook on the web:

Outlook on the web message with the mouse hovering over a link, showing the rewritten urldefense.com address

 

How to know a link was blocked?

If a link is blocked by Proofpoint, you will see the following page in your web browser. This indicates the link was categorized as malicious by Proofpoint's automated security system or the OIT Security team.

Proofpoint block page shown when a link is categorized as malicious

 

How to request access?

If a link is blocked, you can request the link be reviewed and the block removed if the website is not malicious. To request review, please submit a ticket to OIT.

Details

Details

Article ID: 1326
Created
Mon 6/24/19 4:48 PM
Modified
Thu 11/12/26 12:41 AM

Related Articles

Related Articles (3)