How we screen links for phishing and malware
Link shorteners have a deserved reputation for hiding bad destinations. The defence is checking at creation, re-checking on a schedule, and acting fast on reports.
The honest starting point: URL shorteners are useful to phishers for exactly the reason they are useful to everyone else. They hide a long, ugly destination behind something short and neutral. A recipient cannot tell by looking whether a link goes to a delivery tracking page or a credential harvester.
That is a real problem with the format, not a hypothetical one, and any shortener claiming otherwise is not worth using. What differs between providers is what they do about it.
Screening at creation
Every destination is checked before the short link is issued. If a destination fails, the link is refused rather than created. There is no quarantine state where a bad link exists but is inactive, because that state has a habit of leaking.
- The destination is checked against phishing and malware reputation feeds.
- Redirect chains are followed. A clean first hop that bounces through three more to a credential page is a common evasion, so the check resolves the chain rather than the first URL.
- Chains longer than three hops are refused outright, whatever they end at.
- Newly registered domains impersonating banks, couriers, government services or well-known brands are weighted heavily, because that pattern is close to definitional for phishing.
A destination can be clean on Monday and compromised on Thursday. Attackers know this and deliberately register clean pages, get links issued, and swap the content later.
Re-checking on a rolling basis
So screening runs continuously against active links, not just once. Links that start receiving traffic get re-checked more often than dormant ones, because a link nobody is clicking is not currently harming anyone, and attention is finite.
When a re-check fails, the link stops resolving immediately and the account owner is notified. If it was a legitimate site that got compromised, restoring it is a support conversation once the site is clean.
Reports, and what happens to them
Anyone can report a link. You do not need an account, and you do not need to be the recipient. Reports go to abuse@btti.uk, which is monitored daily including weekends.
- 01A credible report is actioned within one working day, and usually much faster.
- 02Confirmed abuse disables the link and suspends the account behind it.
- 03Records are retained rather than deleted, because they are frequently what an investigation needs later.
- 04Child sexual abuse material and terrorism content are referred to the Internet Watch Foundation and the National Crime Agency as appropriate. There is no warning step and no appeal.
The preview page
Where a destination is unusual but not clearly malicious, the link resolves to a preview page showing the full destination before the visitor continues. Link owners can also switch preview on deliberately, and it is a sensible default for links sent to people who did not ask for them.
It costs a click. It also means a recipient who was about to be phished gets to see where they are going first, which is the trade the format has always needed.