How it works:

If the option is enabled for the recipient domain, the LibraCyber appliance rewrites the URIs it finds inside emails so that when the final recipient clicks on the link it doesn’t go to the original URI but, instead, to the EsvaLabs URI Sandbox service. 

Here is an example:

Original URI: http://www.fivl.it 

Rewritten URI: https://urlsand.esvalabs.com/?u=http%3A%2F%2Fwww.fivl.it&e=366181f3&h=6c12b0dd 

When the user clicks on the link, the EsvaLabs URI Sandbox will analyze the target URI in real time by performing lookups on known malware/phishing URI lists and by actively analyzing the contents of the page looking for malicious behavior. 

If the URI has recently been analyzed, the response of the Sandbox will be immediate and, if classified as “clean”, an immediate redirect is performed. If the page has not been recently analyzed, it will be retrieved and scanned, if redirects are found the checks are repeated for all the intermediary URIs. 

This can take up to a few minutes depending on the number of intermediary pages and the speed of the servers serving those pages.

The user is allowed to skip the checks but warned about it, and the complete URI is shown to allow the user to decide whether to trust it or not.

Here is an example of a legit URL.

If the URI is classified as “dangerous” a blocking page is displayed.

The option “I accept the risk and want to follow this dangerous link” can be disabled with the LibraCyber ESG configuration flag “Do not allow users to skip URI Sandbox checks”.

Here is an example of a malicious URL.

If the URI is classified as “suspect” a warning page with the website screenshot preview is displayed to allow visual checks of the requested website.

Here is an example of a suspicious URL.