Rewritten Check Point URL

The format of the rewritten Check Point URL is <click-time domain>_<original url>_<encrypted blob>. While configuring the Click-Time Protection engine, administrators can choose the <click-time domain> from these versions:

  • V1: https://checkpoint.url-protection.com/v1/

  • V2: https://url.checkpoint.click/v2/

In the <click-time domain> V2 version, the original URL is surrounded by underscores, making it easier to identify the original (rewritten) URL. Also, the URL is shorter and the domain is different from V1 version.

Note:

  • Check Point recommends using V2 version.

  • For rewritten QR codes, the structure will be the same as V2 version even if you select to use V1 version.

  • If a Click-Time Protection policy is configured and the Protect (Inline) Internal Traffic option is enabled in the Threat Detection policy, the system rewrites links in emails sent to members of the same organization. See Threat Detection Policy for Internal Emails.

  • For standard email security actions like rewriting URLs. To help maintain the integrity of digitally signed messages, Email Security offers the ability to avoid security modifications for S/MIME-signed emails. See Support for S/MIME-Signed Emails.

Hiding Original URL Full Path

By default, the rewritten URL includes the full path of the original URL, improving readability and predictability for end users. However, if administrators do not want to show the full path, they can configure the Click-Time Protection security engine to rewrite the URL to include only the domain of the original link, obfuscating the remaining path.

  1. Navigate to Security Settings > Security Engines.

  2. Click Configure for Click-Time Protection.

  3. In the Re-written URL field, select one of these:

    • Full original URL included in re-written URL

    • Only original URL domain visible in re-written URL

Note:

Obfuscating the original URL is only supported when the version of the re-written link is v2.

Re-written URL Containing an Obfuscated Original URL

For example, if the original link is https://www.acme.org/lorem/ipsum/dolor.aspx, the re-written link:

  • Without Obfuscation - https://protect.checkpoint.com/v2/___https://www.acme.org/lorem/ipsum/dolor.aspx{}.YXAzOnByb2...{_}

  • With Obfuscation - https://protect.checkpoint.com/v2/___https://www.acme.org/NsyjwsfqrjidLjsjyn.fxuC___.YXAzOnByb2...

Note:

The obfuscation may increase the length of the rewritten link by approximately 2-3 characters compared to the link without obfuscation.

Replacing Links Inside Attachments - Supported File Types

If you configured the Click-Time Protection Policy to replace links inside the attachments, the links get replaced for these file types:

File Type File Extensions
Adobe FDF FDF
Adobe PDF (all versions) PDF
Microsoft Excel 2007 and later XLSX, XLSB, XLSM, XLTX, XLTM, XLAM
Microsoft Excel 2007 Binary XLSB
Microsoft Excel 97 - 2003 XLS
Microsoft PowerPoint 2007 and later PPTX, PPTM, POTX, POTM, PPAM, PPSX, PPSM
Microsoft PowerPoint 97 - 2003 PPT, PPS, POT, PPA
Microsoft Word 2007 and later DOCX, DOCM, DOTX, DOTM
Microsoft Word 97 - 2003 DOC, DOT