Nick Edwards <nick.z.edwa...@gmail.com> wrote:
example the displayed version in mail might be www.example.com, but the actual URI when you highlight or click on it, is foobar.example.net
The most common case is that the text shows the real web page, but the link goes to a click counter page that redirects to the real web page. This is usually not spam but wanted list mail from Mail Chimp, Constant Contact, and friends.
A recent variation is a link going to urldefense.proofpoint.com which redirects to the real web page-- or not, if Proofpoint has found the web page to be malicious by the time the user clicks. Even if you don't use Proofpoint to do this rewriting, you're going to see the result sometimes in replies that include the original, and forwards. Ironically this is an ANTI phishing technique.
I realize you're not interested but other people read this list :-) Joseph Brennan Columbia University
