Decoding of the UrlSand Protection links of the email security suite service Print

Advanced URL Protection with Libraesva UrlSand

As part of the Email Security Gateway solution, Libraesva UrlSand actively blocks malicious URLs in emails, defending against spear-phishing, zero-day exploits, and ransomware.

All links, not only uncategorized ones, are scanned and protected on every device, extending security at the moment of click, not just when the email is received.

How it works

• Every link is rewritten to pass through a secure scanning system.
• The analysis goes beyond blacklist time-of-click checks: it performs a full page scan.
• The system detects deeply nested malware, obfuscated content, and follows all redirects.
• Protection remains active even if the Sandbox is disabled or the appliance is not renewed.

Recovering the original link

The original URL can always be recovered by performing an URL Decode of the u parameter in the querystring.

Example:

Rewritten link:

https://urlsand.esvalabs.com/?u=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Flibraesva%2F&e=dd4f1005&h=8572fddd&f=n&p=y

URL Decoded:

https://urlsand.esvalabs.com/?u=https://www.linkedin.com/company/libraesva/&e=dd4f1005&h=8572fddd&f=n&p=y

Original link:

https://www.linkedin.com/company/libraesva/

Useful tool: URL Decoder Online