From proofpoint
Decodes Proofpoint rewritten URLs (v2/v3), explains rewriting, click-time analysis, sandboxing, and protection verdicts for email security investigations.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin proofpointThis skill uses the workspace's default tool permissions.
Proofpoint URL Defense rewrites URLs in email messages to route clicks through Proofpoint's analysis infrastructure. When a user clicks a rewritten URL, Proofpoint performs real-time analysis of the destination before allowing or blocking access. This provides click-time protection - even if a URL was clean when the email was delivered, it will be analyzed again at the moment the user clicks.
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Migrates code, prompts, and API calls from Claude Sonnet 4.0/4.5 or Opus 4.1 to Opus 4.5, updating model strings on Anthropic, AWS, GCP, Azure platforms.
Analyzes BMad project state from catalog CSV, configs, artifacts, and query to recommend next skills or answer questions. Useful for help requests, 'what next', or starting BMad.
Proofpoint URL Defense rewrites URLs in email messages to route clicks through Proofpoint's analysis infrastructure. When a user clicks a rewritten URL, Proofpoint performs real-time analysis of the destination before allowing or blocking access. This provides click-time protection - even if a URL was clean when the email was delivered, it will be analyzed again at the moment the user clicks.
URL Defense is a critical layer of protection because many attacks use time-delayed weaponization: a URL is clean when the email is sent but becomes malicious hours or days later.
Proofpoint rewrites URLs in email bodies and HTML attachments. The rewritten URL format is:
https://urldefense.proofpoint.com/v2/url?u=<encoded_original_url>&d=<domain_key>&c=<context>&r=<recipient_hash>&m=<message_hash>&s=<signature>&e=
Version 3 format:
https://urldefense.com/v3/__<encoded_url>__;!!<encoded_chars>!<signature>$
| Component | Description |
|---|---|
u | URL-encoded original URL (v2) |
d | Domain key for the organization |
c | Context identifier |
r | Recipient hash |
m | Message hash |
s | HMAC signature for integrity |
e | Empty (reserved) |
When a user clicks a rewritten URL, Proofpoint performs:
| Verdict | User Experience | Description |
|---|---|---|
allow | User proceeds to destination | URL is clean |
warn | Warning interstitial page | URL is suspicious but not confirmed malicious |
block | Block page shown | URL is confirmed malicious |
isolate | Opened in browser isolation | URL is risky, opened in safe container |
In the v2 rewrite format, the original URL is encoded:
- replaces /_ replaces =In the v3 format, the original URL uses a different encoding:
__ delimiters surround the encoded URL!! section$ terminates the URL| Field | Type | Description |
|---|---|---|
originalUrl | string | The original URL before rewriting |
rewrittenUrl | string | The Proofpoint-rewritten URL |
verdict | string | allow, warn, block, isolate |
threatId | string | Threat ID if URL is malicious |
classification | string | malware, phish, spam, clean |
firstSeen | datetime | When the URL was first observed |
lastSeen | datetime | Most recent observation |
clickCount | int | Number of clicks on this URL |
blockCount | int | Number of times clicks were blocked |
redirectChain | string[] | Full redirect chain to final URL |
finalUrl | string | Final destination after redirects |
certificate | object | SSL certificate details of the destination |
| Field | Type | Description |
|---|---|---|
encodedUrl | string | The Proofpoint-rewritten URL provided |
decodedUrl | string | The original URL extracted |
version | string | Rewrite version (v2 or v3) |
valid | boolean | Whether the URL is a valid Proofpoint rewrite |
| Tool | Description | Key Parameters |
|---|---|---|
proofpoint_url_decode | Decode a Proofpoint-rewritten URL | url |
proofpoint_url_analyze | Analyze a URL for threats | url |
proofpoint_url_get_clicks | Get click activity for a URL | url, sinceSeconds |
proofpoint_url_get_verdict | Get the current verdict for a URL | url |
proofpoint_url_batch_decode | Decode multiple URLs at once | urls[] |
proofpoint_url_decode with the full rewritten URLproofpoint_url_analyze to check the URL's current threat statusproofpoint_url_analyze with the URLproofpoint_url_get_clicks to see who clickedproofpoint_url_batch_decode with the array of URLsproofpoint_url_get_clicks with the URLproofpoint_url_get_verdict for a URL that was previously cleanblock, check if any users received emails containing the URLTo manually decode a v2 Proofpoint URL:
u= parameter value- with /_ with =Input: https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_path-3Fparam-3Dvalue&d=...
Step 1: https-3A__example.com_path-3Fparam-3Dvalue
Step 2: https-3A//example.com/path-3Fparam-3Dvalue
Step 3: https-3A//example.com/path-3Fparam=value
Step 4: https://example.com/path?param=value
To manually decode a v3 Proofpoint URL:
__ delimiters!! sectionInput: https://urldefense.com/v3/__https://example.com/path__;!!ABC123!def$
Output: https://example.com/path
Note: Always use the proofpoint_url_decode tool rather than manual decoding to ensure accuracy.
| Code | Message | Resolution |
|---|---|---|
| 400 | Invalid URL format | Ensure the URL is a valid Proofpoint-rewritten URL |
| 400 | Unsupported URL version | Only v2 and v3 formats are supported |
| 401 | Authentication failed | Verify service principal and secret |
| 403 | URL Defense API not enabled | Ensure your license includes URL Defense API |
| 404 | URL not found | The URL may not have been processed by Proofpoint |
| 429 | Rate limit exceeded | Implement backoff |
| Issue | Cause | Resolution |
|---|---|---|
| Invalid signature | URL was modified after rewriting | The URL may have been truncated or altered |
| Unknown version | URL does not match v2 or v3 format | It may not be a Proofpoint URL |
| Expired URL | URL is older than the retention period | Original URL cannot be recovered from the API |
proofpoint_url_decodeproofpoint_url_batch_decode