1. Starts with prefix: www, http or https
2. For emails with HTML content, it will check if the URL appears in a href attribute
Once that criteria is met, the Time-Of-Click service will rewrite URLs based on your configured Web Reputation settings policy as shown in the screenshot below:
The explanation of these categories is as follows:
A. Apply to URLs that have not been tested by Trend Micro:
Includes URLs classified by WRS as Category 90 (untested).
B. Apply to URLs marked by Web Reputation Services with smart flags:
Includes URLs classified by WRS as having a "smart flag".
In IMSVA, the following categories result in having the "smart flag":
Category 56 (sharing service)
Category 90 (untested)
Category 93 (new domain)
C. Apply to all URLs:
All the URLs will be rewritten.
Also, if the setting "Apply to URLs in digitally signed messages" is not selected, it will NOT rewrite URLs in emails that have been digitally signed (e.g. emails with DKIM signatures)