On the web, SipherMail checks a link when you click it in a message. The check uses no outside service. Links are not rewritten, so hovering still shows the real address, and nothing is routed through a redirect.
What you see#
- No warning signs: the link opens in a new tab. A quick check on SipherMail’s servers runs as the tab opens. If the check finds a problem, the tab is closed instead. If the server cannot be reached, the link opens, because the local check already passed.
- Warning signs found: a window opens before anything loads. It is titled Check this link before you open it, or This link looks unsafe for the most serious signs. It shows the full address and offers Copy link, Don’t open, and Open link or Open anyway.
Links that start with mailto:, tel: or sms:, links to the same SipherMail page, and # anchors are left alone.
Warning signs it looks for#
| Sign | Example |
|---|---|
| Blocklisted | The site is on SipherMail’s own list of known bad hosts. |
| Address as host | The link goes to a bare IP address. |
| Hidden destination | A name@host trick in the address. |
| Mixed alphabets | A site name that mixes Latin letters with Cyrillic or Greek ones. |
| Look-alike | A site name that resembles the sender’s domain but is a different one. |
| Text mismatch | The visible link text shows one domain and the link goes to another. |
| URL shortener | A known shortening service, so the real destination cannot be checked. |
| Unsafe scheme | Addresses that start with javascript: or data:. |
What it cannot do#
- It does not look at the page you open. A link with no warning signs can still lead to a harmful site.
- The blocklist is a local list, not a live feed of every threat.
- It is a prompt to look twice. If a message asks you to sign in or pay, go to the site yourself instead of using the link.
To tell us about a message, use Report in the message menu. See Block and allow senders. For how images in mail are handled, see Image privacy.