So, I have this email with a Short URL link. What now?

These days, you are liable to see links that are known as “Short URLs” without even realizing it. These are very helpful in situations where you are limited to a certain number of characters or a long URL does not look good, and are now often done by software and social channels automatically. This is wonderful, except that they hide where the link will take you. The bad guys know this, and use it against you in phishing attacks and other Social Engineering ploys. So how do you identify a short URL, and what can you do about it?

Hover here and look at the bottom of your browser. You should see



Short URLs are generally easy to identify as they typically point to domains such as “”, “”, “”, “”, “” or something similar. For example, here are links to from each of these:

Now this may not seem like it’s doing much, if anything, but the real power comes when you have a long URL and need it to be more manageable. Take for example the URL, This links to a webpage at my employer, KnowBe4 but at 75 characters, that’s starting to get pretty long. If I use a URL shortener, this is what it would look like:


The Problem and Solution

As you can see, that is quite a difference. A side effect to this is, you can’t see where the link takes you. Make a button link a Small URL, and it is very easy to hide a malicious URL. For example, this button links to the KnowBe4 page, but how can you tell? Hovering over it just gives you the Short URL.

So what do you do? In most cases, adding a “+” sign to the end of the Short URL will take you to a preview page where you can see the full URL. There are exceptions, like TinyURL, that require you to do something different, such as add “preview.” to the beginning of the shortened URL. To get the URL to use, simply hover over the link with your mouse, right-click and choose “Copy Link Address” or a similar choice.


Data from

Here are some examples of preview links:

On a side note, links give an entire analytics view of that Short Url. For example, check out and you can see the data. and have proven to be a bit more difficult. In this case, using a service such as Unshorten URL  or to preview the link may be your best bet. This will also work with the other short URLs. Once you have pasted the link in to the site, you should be able to see the real website the link is taking you to. If it’s not what you expect, don’t click it!

This may seem difficult at first, but once you have done it once or twice, it’s very easy to make sure you are staying safe from hidden malicious URLs.



Erich Kron is the Security Awareness Advocate at KnowBe4, and has over 20 years’ experience in the medical, aerospace manufacturing and defense fields. He is the former security manager for the US Army 2nd Regional Cyber Center-Western Hemisphere.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.