From proofpoint
Decodes Proofpoint rewritten URLs (v2/v3), explains rewriting, click-time analysis, sandboxing, and protection verdicts for email security investigations.
How this skill is triggered — by the user, by Claude, or both
Slash command
/proofpoint:url-defenseThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Proofpoint URL Defense rewrites URLs in email messages to route clicks through Proofpoint's analysis infrastructure. When a user clicks a rewritten URL, Proofpoint performs real-time analysis of the destination before allowing or blocking access. This provides click-time protection - even if a URL was clean when the email was delivered, it will be analyzed again at the moment the user clicks.
Proofpoint URL Defense rewrites URLs in email messages to route clicks through Proofpoint's analysis infrastructure. When a user clicks a rewritten URL, Proofpoint performs real-time analysis of the destination before allowing or blocking access. This provides click-time protection - even if a URL was clean when the email was delivered, it will be analyzed again at the moment the user clicks.
URL Defense is a critical layer of protection because many attacks use time-delayed weaponization: a URL is clean when the email is sent but becomes malicious hours or days later.
Proofpoint rewrites URLs in email bodies and HTML attachments. The rewritten URL format is:
https://urldefense.proofpoint.com/v2/url?u=<encoded_original_url>&d=<domain_key>&c=<context>&r=<recipient_hash>&m=<message_hash>&s=<signature>&e=
Version 3 format:
https://urldefense.com/v3/__<encoded_url>__;!!<encoded_chars>!<signature>$
| Component | Description |
|---|---|
u | URL-encoded original URL (v2) |
d | Domain key for the organization |
c | Context identifier |
r | Recipient hash |
m | Message hash |
s | HMAC signature for integrity |
e | Empty (reserved) |
When a user clicks a rewritten URL, Proofpoint performs:
| Verdict | User Experience | Description |
|---|---|---|
allow | User proceeds to destination | URL is clean |
warn | Warning interstitial page | URL is suspicious but not confirmed malicious |
block | Block page shown | URL is confirmed malicious |
isolate | Opened in browser isolation | URL is risky, opened in safe container |
In the v2 rewrite format, the original URL is encoded:
- replaces /_ replaces =In the v3 format, the original URL uses a different encoding:
__ delimiters surround the encoded URL!! section$ terminates the URL| Field | Type | Description |
|---|---|---|
originalUrl | string | The original URL before rewriting |
rewrittenUrl | string | The Proofpoint-rewritten URL |
verdict | string | allow, warn, block, isolate |
threatId | string | Threat ID if URL is malicious |
classification | string | malware, phish, spam, clean |
firstSeen | datetime | When the URL was first observed |
lastSeen | datetime | Most recent observation |
clickCount | int | Number of clicks on this URL |
blockCount | int | Number of times clicks were blocked |
redirectChain | string[] | Full redirect chain to final URL |
finalUrl | string | Final destination after redirects |
certificate | object | SSL certificate details of the destination |
| Field | Type | Description |
|---|---|---|
encodedUrl | string | The Proofpoint-rewritten URL provided |
decodedUrl | string | The original URL extracted |
version | string | Rewrite version (v2 or v3) |
valid | boolean | Whether the URL is a valid Proofpoint rewrite |
| Tool | Description | Key Parameters |
|---|---|---|
proofpoint_url_decode | Decode a Proofpoint-rewritten URL | url |
proofpoint_url_analyze | Analyze a URL for threats | url |
proofpoint_url_get_clicks | Get click activity for a URL | url, sinceSeconds |
proofpoint_url_get_verdict | Get the current verdict for a URL | url |
proofpoint_url_batch_decode | Decode multiple URLs at once | urls[] |
proofpoint_url_decode with the full rewritten URLproofpoint_url_analyze to check the URL's current threat statusproofpoint_url_analyze with the URLproofpoint_url_get_clicks to see who clickedproofpoint_url_batch_decode with the array of URLsproofpoint_url_get_clicks with the URLproofpoint_url_get_verdict for a URL that was previously cleanblock, check if any users received emails containing the URLTo manually decode a v2 Proofpoint URL:
u= parameter value- with /_ with =Input: https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_path-3Fparam-3Dvalue&d=...
Step 1: https-3A__example.com_path-3Fparam-3Dvalue
Step 2: https-3A//example.com/path-3Fparam-3Dvalue
Step 3: https-3A//example.com/path-3Fparam=value
Step 4: https://example.com/path?param=value
To manually decode a v3 Proofpoint URL:
__ delimiters!! sectionInput: https://urldefense.com/v3/__https://example.com/path__;!!ABC123!def$
Output: https://example.com/path
Note: Always use the proofpoint_url_decode tool rather than manual decoding to ensure accuracy.
| Code | Message | Resolution |
|---|---|---|
| 400 | Invalid URL format | Ensure the URL is a valid Proofpoint-rewritten URL |
| 400 | Unsupported URL version | Only v2 and v3 formats are supported |
| 401 | Authentication failed | Verify service principal and secret |
| 403 | URL Defense API not enabled | Ensure your license includes URL Defense API |
| 404 | URL not found | The URL may not have been processed by Proofpoint |
| 429 | Rate limit exceeded | Implement backoff |
| Issue | Cause | Resolution |
|---|---|---|
| Invalid signature | URL was modified after rewriting | The URL may have been truncated or altered |
| Unknown version | URL does not match v2 or v3 format | It may not be a Proofpoint URL |
| Expired URL | URL is older than the retention period | Original URL cannot be recovered from the API |
proofpoint_url_decodeproofpoint_url_batch_decodenpx claudepluginhub wyre-technology/msp-claude-plugins --plugin proofpointInvestigates phishing email incidents from user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools.
Analyzes suspicious URLs using URLScan.io in isolated environments, capturing screenshots, DOM, HTTP requests, JS behavior, and extracting IOCs for phishing and malware investigation.
Analyzes Checkpoint Harmony Email (Avanan) threats including phishing, malware, BEC, ATO; extracts IOCs, builds threat timelines, assesses severity for email security investigations.