0

recently, we are seeing some From:, To:, Cc: addresses being rewritten from [email protected] to:

https://3c-lxa.mail.com/mail/client/mail/mailto;jsessionid=36725F1B090973DAF815646A3B096862-n1.lxa15a?to=user1%40companyA.com

i've checked RFC 822, and 2822 and the above does not seem to be valid address specification formats. Are there some other RFC or email clients that handles the above links ?

Also, links in the emails of the form www.companyA.com are also rewritten into:

www.companyA.comhttps://3c-lxa.mail.com/mail/client/dereferrer?redirectUrl=http%3A%2F%2Fwww.companyA.com%2F

what could have caused the above changes and what are the implications ?

3
  • Where are you seeing them replaced as that? Is it in the mail client or in the header itself? It appears like the client is just parsing the e-mail and then replacing it with a link to part of the webmail interface. Oct 31, 2014 at 13:53
  • Thanks AJ, sorry for the late response, was away for a while. i see it in email thread that the user forwarded to me.. looks like it is in the message headers ? sam
    – ssgam
    Nov 11, 2014 at 6:25
  • Right, what kind of client are you viewing it in though? Nov 11, 2014 at 7:33

1 Answer 1

1

What program are you using to view the email?

It looks as if you are using the web interface from mail.com to read the email (mail.com is an email provider).

If this is the case, they are simply using an intermediate script as target of the addresses. When you click an address from the webmail, the goal is that the user writes a new email to that address, so it needs to be rewritten, instead of having the webmail opening a local MUA.

In the second case, where it is a http url, the name suggests that you are being redirected through https://3c-lxa.mail.com/mail/client/dereferrer?redirectUrl=… in order to conceal the url from which you were reading your email, as that might contain sensitive information, such as session tokens, your address, etc.

1
  • Thanks Angel, sorry for the late response, was away for a while. the users stopped pursuing it, so i have no more accesses to them. i'll remember the your very helpful info; when they come back again, i'll ask the appropriate questions .. sam
    – ssgam
    Nov 11, 2014 at 6:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .