0

recently, we are seeing some From:, To:, Cc: addresses being rewritten from user1@companyA.com to:

https://3c-lxa.mail.com/mail/client/mail/mailto;jsessionid=36725F1B090973DAF815646A3B096862-n1.lxa15a?to=user1%40companyA.com

i've checked RFC 822, and 2822 and the above does not seem to be valid address specification formats. Are there some other RFC or email clients that handles the above links ?

Also, links in the emails of the form www.companyA.com are also rewritten into:

www.companyA.comhttps://3c-lxa.mail.com/mail/client/dereferrer?redirectUrl=http%3A%2F%2Fwww.companyA.com%2F

what could have caused the above changes and what are the implications ?

  • Where are you seeing them replaced as that? Is it in the mail client or in the header itself? It appears like the client is just parsing the e-mail and then replacing it with a link to part of the webmail interface. – AJ Henderson Oct 31 '14 at 13:53
  • Thanks AJ, sorry for the late response, was away for a while. i see it in email thread that the user forwarded to me.. looks like it is in the message headers ? sam – ssgam Nov 11 '14 at 6:25
  • Right, what kind of client are you viewing it in though? – AJ Henderson Nov 11 '14 at 7:33
1

What program are you using to view the email?

It looks as if you are using the web interface from mail.com to read the email (mail.com is an email provider).

If this is the case, they are simply using an intermediate script as target of the addresses. When you click an address from the webmail, the goal is that the user writes a new email to that address, so it needs to be rewritten, instead of having the webmail opening a local MUA.

In the second case, where it is a http url, the name suggests that you are being redirected through https://3c-lxa.mail.com/mail/client/dereferrer?redirectUrl=… in order to conceal the url from which you were reading your email, as that might contain sensitive information, such as session tokens, your address, etc.

  • Thanks Angel, sorry for the late response, was away for a while. the users stopped pursuing it, so i have no more accesses to them. i'll remember the your very helpful info; when they come back again, i'll ask the appropriate questions .. sam – ssgam Nov 11 '14 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.