How it works
Clients on one side, backends on the other, Scorpion in between.
Scorpion terminates the client connection and talks to your backends separately, so each side can be whatever it needs to be.
01The path
Mail clients
IMAP, POP3, webmail→
Scorpion
TLS 1.3, IPv6, routing by name→
Your backends
Any server, old or new- One entry point. Clients always connect to Scorpion: one process, one endpoint, even with several incoming IPs. It routes each one to the right backend by the name they connected to, using TLS SNI and/or single-entry-point (SEP) names such as mail.example.com and mail.other-example.com. The same person can hold user@example.com and user@other-example.com and land on the right backend for each.
- Routing by login. Routing can also follow the login itself, by a MySQL, PostgreSQL or LDAP query of user and domain.
- Seamless migration. Because clients never address a backend directly, moving a user or a whole domain between servers is a routing change, not a client change.
- IPv6 in front. Backends that are not IPv6 or dual-stack aware become reachable over IPv6.
- Modern TLS in front. Clients get the latest TLS protocols and options whatever the backend supports. A backend that only offers TLS 1.0, or even plain text, still gives its clients TLS 1.3.
- Certificates handled. Let's Encrypt certificates for client access are automated at Scorpion.
02Click-time URL protection
- When a recipient clicks a link, Scorpion asks MISUIC to classify it. MISUIC can run locally, and optionally as a remote service.
- MISUIC's structural checks (does this domain belong to the brand it claims?) are corroborated by SURIBS reputation history.
- The recipient is let through, warned, or stopped, depending on severity.
This applies to IMAP and POP3 access, and to some webmail systems.
| Verdict | Meaning | At the click |
|---|---|---|
| Dangerous | Phishing or malware; impersonates a brand it does not belong to | Blocked, no override |
| Malicious | Likely scam or extortion | Blocked; recipient may override, not recommended |
| Spam | Likely bulk or click spam | Blocked; recipient may override at own risk |
| Unknown | Nothing has earned trust, nothing has condemned it | Safe is never assumed, only earned |
| Safe | Known brand domain or confirmed-good host | Passed through |
Severity definitions follow MISUIC's published rule ladder.
03URL audit trails
- Scorpion keeps a URL audit trail in its interface.
- When a site is classified as bad after the fact, you can see who clicked through before it was classified, and so who may be compromised.
- Used together with the rspamd service plugin, you are also alerted to everyone who received the message.
04Where it runs
On anything new or old, big or small: from AWS and enterprise hardware to a Raspberry Pi and Solaris 10. Cloud or on-premises, with data sovereignty kept in Europe and Australia.
05Licensing
- By mailbox count, not email addresses.
- Set at the start of the year.
- Growth in mailboxes does not change the licence until renewal.
Next step
See it in front of your own servers.
Tell us about your platform and we will scope a pilot.