Get effective URL from masqueraded URL

Hello David,

what's the use case for this?

Hello,

thanks for answering.

The specific use case for this scenario is pretty simple. If a user submits a potentially suspicious E-Mail to us, I want to verify the URL's which might be contained in the E-Mail. Therefore I need to see the effective URL.

Best Regards,

David

This is already doublechecked by Sophos Time of Click. 

We do not offer a full decryption option. See: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/EmailSecurity/EmailSecurityPolicy/EmailURLProtection/index.html#malicious-url-scan 

You can view the original URL in the Message History details if it is something you want to investigate further. Search for the message and then click the Subject and the URL tab.

To sum up:

LuCar Toni Sophos Time of Click Protection is not the solution for this problem. As an IT-Administrator I want to check submitted Emails from users for malicious content, here I am not relying on the Time of Click Protection. Furthermore, the Time of Click Protection is for sure useful, but we all know that it is not the jack of all trades.

Tom Foucha Thanks for answering, but as mentioned in my initial post the solution you suggest is very cumbersome for everyday use, a simple tool which converts the URL back to the effective URL would be much more convenient.

I think this is a feature that should be added in Sophos Central.

Thanks for all your thoughts, but I think the best way of figuring out the effective URL at the moment is to use third-party tools like, urlscan.io or wheregoes.

Best Regards,

David

To sum up:

LuCar Toni Sophos Time of Click Protection is not the solution for this problem. As an IT-Administrator I want to check submitted Emails from users for malicious content, here I am not relying on the Time of Click Protection. Furthermore, the Time of Click Protection is for sure useful, but we all know that it is not the jack of all trades.

Tom Foucha Thanks for answering, but as mentioned in my initial post the solution you suggest is very cumbersome for everyday use, a simple tool which converts the URL back to the effective URL would be much more convenient.

I think this is a feature that should be added in Sophos Central.

Thanks for all your thoughts, but I think the best way of figuring out the effective URL at the moment is to use third-party tools like, urlscan.io or wheregoes.

Best Regards,

David

You could try to use URL: https://intelix.sophos.com/

To be honest, I don't think the URL protection is perfectly implemented either. But I'm more concerned here with the user's perspective because it is always difficult to see the effective URL. I know from other products that after clicking on the link, another page appears which shows the user the effective URL. The user can then decide whether they want to open the website or not.

You can see the domain by looking into the URL: It is showing after the D= 

It is about "How much do you want to disturb the users". I would not agree a landing page would be valuable for the users in the first place. 

You can see the domain, it is going to by mouse over (on windows/macOS).  

That's true, but is it reasonable to expect a user to do this? To look for the D=Domain.com in a mile-long URL? I do not think so. My experience is that the users, who need to go through a dialog to access the URL which was placed in the E-Mail, are more aware of potential security risk.

Keep in mind, this would imply ALL Links will have a dialog box - I am just thinking about - this would highly influence the experience of the user in the long run. 

This is only partially true, if implemented correctly, a whitelist could be created with internal addresses or there URL's which are known to be safe. Although I can understand your concern. I have used such a System in the past and it worked pretty well, I do admit that this may vary with different types of users.