Why are the URLs in my incoming emails rewritten? – SUNSTAR

SUNSTAR takes a proactive approach to protect users from phishing attacks by implementing PhishProtection from DuoCircle.
The URLs in your incoming emails are rewritten to https://urlf.sg.sunstar.com/?url=https://somedestination.com/ as part of the URL defense.
When you clicked on the rewritten URLs, PhishProtection will check if they are malicious or otherwise. It will take a seconds or two for this real time check.
If all is good, you will be redirected to your destination website without further interaction.
Otherwise, a red warning page will be presented to warn you about the malicious website ahead. A sample warning page looks like this https://urlf.phishprotection.com/?demo=true&id=15f1&js=true. You will be advised not to proceed further.
For further assistance, please contact IT team.