Calvin Ardi
Calvin Ardi
Similar to #5, Outlook will rewrite URLs with `*[.]safelinks[.]protection[.]outlook[.]com`, so at some point you get an abomination of multiple entities rewriting each others' URLs. We should find and unwrap these,...
Sometimes the URLs are mangled multiple times, e.g., ``` https://urldefense[.]us/v2/url?u=https-3A__urldefense[.]com_v3_ ``` It used to be the case that if a URL already had the form of `http://urldefense[.]com/...`, the middlebox wouldn't...
https://twitter.com/malware_traffic/status/1043174079828770817 
A Proofpoint URL takes the format of the following: `urldefense.proofpoint.com/v2/url?[params]` where `[params]` consists of the following: `c` := constant (per organization) `d` := constant (per organization) `e` := always empty?...