Shortened URLs:
What are they and why should I care?
Have you ever noticed really long web addresses? (A web address is called URL.) Many people find them annoying to copy and paste, or send to friends, because they are so long. Back in 2002 a website named TinyURL started a service in which you could paste your long URL in one field and TinyURL would produce a short code in another field that represented the long URL.
The service could take something like this:
and turn it into something like this:
Since 2002, dozens of URL shortening services have been created. Some of these services allow you to visit their website and enter the shortened URL you may have received to look up where the link points to before clicking. However, many URL shortening services do not offer that ability. And that is why malware writers (the people who create nasty software to harm us and our computers) love to use these services!
Malware writers use shortening services to disguise where a link actually leads to on the Internet.
Here are several examples of shortening services that have been commonly misused by malware writers:
| http://bit.ly | http://is.gd |
| http://kxk.me | http://ity.im |
| http://lnk.co | http://tiny.cc |
| http://ow.ly | http://t.co [Twitter’s shortening service] |
| http://goo.gl [Google’s shortening service] | https://rb.gy |
…and there are others. Scammers have even misused Digg.com, a popular news reader website. We once posted something on Craig’s List and in less than a day we received 2 emails containing VERY suspicious links to two different Digg.com addresses such as digg.com/u3Uh2F?igjkkwq (Altered to protect from accidental clicks). We contacted Digg.com and then confirmed that it was a trick by malware writers to send us to a website that causes a computer infection.
Below are two scams that used shortened URL’s. The first was an email made to look like it came from America’s Got Talent, delivered in September, 2018. The second is a work-at-home pitch. Both shortened links are more likely to lead to a computer infection than money, work or free stuff!
Hello,
Thank you for your interest.
Vote: Is Jackie Evancho America’s Got Talent 2018 champion?
BONUS: Vote Now and Qualify to Receive a FREE Gift Card,IPOD,FREE game,MacBook!
please visit: htp: /bit.ly/3wKrm–
[Link modified to protect against accidental click.]
Here is another dangerous example how cybercriminals use a link shortening service in texts to target you…
WHAT CAN YOU DO TO PROTECT YOURSELF?
Anytime you see a shortened URL, don’t click on it. There are several tools available to decipher where a shortened link leads to BEFORE you click on it! If you are sent a shortened link and are the least bit suspicious, try copying the short link and pasting it into one of these services to inform you where the link points to:
https://urlex.org/
https://unshorten.it/
http://urlxray.com/
http://longurl.org/
https://wheregoes.com/
ARTICLES RELATED TO THIS SCAM:
1. Spammers Storm URL Shortening Services
2. URL shorteners can hurt deliverability: which one should you use?
3. Shortened URLs Pose a Hidden Threat [Recent research from Web of Trust found that 8.7% of websites reached via TinyURL service, and 5.0% via Bit.ly pointed to sites that were very suspicious and/or deemed risky for children.]