The Mechanism of Blind HTTP Redirection
When clicking a shortened link, the browser sends a request to the shortening service server, which returns a redirect status response (301 or 302 Redirect). Because the message text displays a trusted domain from a popular service, automated antivirus scanners often let such messages pass into the Inbox.
How to Safely Check Hidden Addresses
- Add a special plus symbol to the end of a short link to view stats and the final destination
- Use online utilities to preview redirects without physically visiting the site
- Verify the final domain via suspicious network resource databases before entering credentials
- Avoid logging into services accessed via a chain of automatic redirects