9
Proposal to implement a link tracking feature
Idea shared by Roger - 1/29/2025 at 11:21 AM
Proposed
Hello community

As part of IT security measures, it is crucial to recognize threats such as phishing or targeted attacks at an early stage and to react to them. An effective means of analyzing such incidents is a link tracking mechanism within the mail server. This feature is designed to work in a similar way to Microsoft's SafeLink and makes it possible to track which user clicked on which link and when. This allows targeted countermeasures to be taken to curb security breaches and minimize future risks.

Objective
The main objective of this feature is...
  • To enable the traceability of accessed links in emails.
  • To ensure a targeted and rapid response to security breaches.
  • To enable the feature to be activated or deactivated individually for each domain.
  • To take data protection and compliance requirements into account.

Link tracking & redirection
  • Each link contained in an e-mail is automatically replaced by a tracking URL when it is received.
  • The tracking URL first redirects the user via the mail server before being forwarded to the actual target address.
  • During the redirection, the click event is logged with the following data:
  • User (e-mail address)
  • Date and time of the click
  • Original URL
  • Client IP address (optional)
  • Mail ID (to assign the original email)

Configurability per domain
  • Administrators can activate or deactivate link tracking individually for each managed domain.
  • The function should be deactivated by default in order to require conscious activation.

Reporting and analysis options
  • Domain administrators receive a central overview of all mailboxes and can generate reports on links accessed.
  • Each user can see which links they have accessed for their own mailbox.
  • Filter and search functions enable targeted analysis of potential threats.
  • Real-time alerts can inform administrators when known dangerous links have been clicked on.

Security mechanisms
  • Ability to automatically block suspicious or malicious links or warn the user.
  • Support for integration with threat intelligence services to detect malicious URLs.
  • Protection against circumvention through manipulation of tracking links.

Web interface for administration and reports
  • Provision of a web-based dashboard for administrators and end users.
  • Implementation of filter and search functions for targeted analysis of link clicks.

Data protection and compliance
  • Storage of tracking data with clearly defined retention periods.
  • Compliance with data protection regulations such as the GDPR (option to deactivate per domain or individual opt-out for users).
The implementation of a link tracking feature in the mail server offers a significant improvement in the security situation within an organization. It makes it possible to specifically identify security breaches and take appropriate measures. Administrators and end users alike can benefit from flexible configuration per domain and the provision of detailed reports.

I would be interested to hear your opinions and input and look forward to receiving feedback from the community and, of course, the SmarterTool team.

Best regards,

Roger

2 Replies

Reply to Thread
1
Yes, I can really see the value in this.  We work with a number of smaller organizations and the users are typically case managers and not really power computer users to recognize fake emails and phishing attempts. Recently our server and multiple domains have been getting hit with fake admin emails like : 

"your mailbox is full and has been restricted. Please login and verify your account to lift the restrictions." 

Just yesterday one of the staff of a non profit almost fell for it. She did in fact click on the links and started to log in, she then said she noticed something that made her question it and then contacted me directly. She forwarded me the emails as she was not sure it was really from us, but the damage may have been done.

When I used FireFox to try to click on that same link, (we do investigate what they do and where they go) Firefox responded with a red screen saying it was a scam website. I dont know how many others in her org got hit with the same email, 

What would be nice is to be able to catch those and even potentially redirect them to a page we control instead. "This link was sending you to a scammers website. We intercepted it. Stop clicking on things and verify the info with us first !"
www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !
0
I think that's a good additional idea from you Curtis, thank you.

Reply to Thread