Why Short Links Look Suspicious

1. Why the suspicion is rational

It is tempting to treat distrust of short links as superstition. It is not. It is a correct inference from how the format works.

The single most useful signal an ordinary person has for judging a link is the domain name. yourbank.com versus yourbank-secure-login.xyz is a judgement almost anyone can make in under a second. A short link removes that signal entirely. Every link becomes eleven characters on a domain that tells you nothing about the destination.

Phishing needs exactly that property. So does malware distribution, so does affiliate cloaking, so does every scam that depends on you not looking closely. The technique is not incidental to the abuse — it is the mechanism.

So when a security awareness course tells staff to be wary of shortened URLs, it is giving sound advice. The awkward consequence for everyone using short links legitimately is that the advice does not distinguish between you and the attacker, because from the outside there is nothing to distinguish.

2. What makes a particular link look worse

Not all short links read the same. These are the properties that push a link from “short” to “suspicious”, roughly in order of how much damage they do:

• No context. A bare link with no sentence around it is the single strongest signal. Every phishing message in existence is a link with minimal context.
• Unexpected arrival. A link in a message you did not anticipate, from an address you do not recognise, about an account you may not have.
• Urgency. “Within 24 hours”, “account will be suspended”, “verify immediately”. Urgency exists to stop you checking.
• A mismatch between claim and domain. Text saying it goes to your bank; a domain that is a shortener.
• A shortener with a bad reputation. Some domains have been abused heavily enough that filters treat them as evidence on their own.
• Chained shorteners. A short link resolving to another short link has essentially one purpose, and it is not a good one.

Read that list again as an author rather than a recipient and it becomes a checklist. The things that make links look suspicious are mostly things you control.

3. Spam filters, email deliverability and security software

People are not the only audience judging your link. Three kinds of automated system form an opinion before a human sees it.

Email spam filters

Shortener domains are a documented spam signal, and a long-standing one. A short link will not by itself send a message to junk, but it contributes, and it contributes more when combined with the usual suspects: an unfamiliar sending domain, missing authentication records, a high link-to-text ratio, urgent subject lines.

The practical guidance for anyone sending email at volume: do not use a public shortener in email. Use your real destination URL, or a branded domain you control. Shortening in email buys you almost nothing — email clients do not have a character limit — and costs deliverability.

Corporate security gateways

Many organisations rewrite or detonate links in a sandbox before delivery, and some block shortener domains outright. If you are sending to business addresses, a short link is materially more likely to be stripped, rewritten into something unrecognisable, or blocked.

Platform moderation

Several large subreddits auto-remove posts containing shorteners. Some forums do the same. This is not hostility to the format so much as accumulated experience of what shorteners are used for in those contexts.

4. How to check a short link before clicking it

You never have to guess. Every method below shows you the destination without visiting it.

Add a plus sign

On URLVanish, adding + to the end of any link opens a preview page instead of redirecting: urlvanish.com/abc123+. It shows the destination domain and the full address, and it does not send you there. Several other shorteners support the same convention, which dates back to bit.ly.

Use a checker

Paste the link into the link checker and it resolves it and shows you where it points, without following it in your browser.

Use the expand API

For scripts and bulk checking: https://urlvanish.com/api/expand?format=simple&url=SHORT_LINK returns the destination as plain text without counting a click.

Read the destination properly once you have it

Expanding is only half the job. Once you can see the address, look at the domain, and specifically at the part immediately before the first single slash. That is the real domain. Everything to the left of it can be made to say anything:

https://yourbank.com.secure-login.example.net/verify
                     ↑ the real domain is example.net

This is the single most common trick and it survives being expanded, because the expanded URL genuinely does contain your bank’s name. Look for the last dotted component before the slash.

5. How to make your own short links look trustworthy

Assume your recipient is appropriately suspicious and give them what they need.

1. Write the context. “Here is the venue map for Thursday” plus a link beats a bare link by an enormous margin. This is the highest-value change on the list and it costs one sentence.
2. Use a descriptive custom alias. urlvanish.com/venue-map carries meaning. urlvanish.com/a7f3c2d1 carries none. An alias restores a fraction of the signal that shortening removed.
3. Say the destination in the text. “This goes to our Google Doc” lets the reader verify rather than trust.
4. Tell them about the preview. “Add a + to the end if you want to see where it goes first” signals that you have nothing to hide, and almost nobody does it, so it stands out.
5. Do not shorten in email. See above. Use the real URL.
6. Never chain shorteners. If your source is already short, post it as-is.
7. Keep one link per purpose. Reusing one link for six campaigns makes it look recycled and destroys your own measurement.

6. Are shortened URLs always dangerous?

This question appears in security-awareness quizzes often enough that people search for it verbatim, and the expected answer in most courses is no.

Shortened URLs are not inherently malicious. They are a redirect — the same mechanism every website uses when it moves a page. Hundreds of millions of entirely ordinary short links exist, on conference badges, in podcast scripts, in bios, in QR codes on restaurant tables.

What is true is narrower and more useful:

• A shortened URL conceals its destination, which removes the recipient’s main safety check.
• That concealment is attractive to attackers, so the proportion of malicious links among short links is higher than among links generally.
• A short link is exactly as safe as its destination, and the shortener does not make an unsafe destination safe.
• The risk is removable: expand it and the concealment is gone.

So: not always dangerous, always opaque, and the opacity is the part you can do something about — in one direction by checking links you receive, and in the other by giving the people you send links to enough context that they do not have to.

Frequently asked questions

Are shortened URLs always dangerous?

No. A shortened URL is a redirect and is exactly as safe as the address it points at. What it always does is conceal the destination, which removes the main check a person uses to judge a link — and that concealment is attractive to attackers, so the proportion of malicious links is higher among short links than among links in general.

Why do short links look suspicious?

Because the domain name is the main signal people use to judge a link, and shortening removes it. Phishing depends on exactly that property, so security training teaches people to distrust shortened URLs. The advice is sound and cannot distinguish between legitimate and malicious senders.

How can I see where a short link goes without clicking it?

Add a plus sign to the end of a URLVanish link — urlvanish.com/abc123+ — to open a preview page showing the destination without going there. You can also paste it into the link checker, or call the expand API, which resolves it without counting a click.

Do short links hurt email deliverability?

They can. Shortener domains are a long-standing spam signal and contribute to a message being filtered, particularly alongside an unfamiliar sending domain or missing authentication records. Since email has no length constraint, there is little to gain: use the real URL in email.

Why do some subreddits and forums remove posts with short links?

Because shorteners are commonly used to get around domain blocklists, several communities auto-remove any post containing one. It is a response to how the format is abused rather than to the format itself. On those platforms, post the real address.

How do I make my short links look more trustworthy?

Write a sentence of context around the link, use a descriptive custom alias instead of a random code, name the destination in your text, and tell people they can add a plus sign to preview it first. Context is by far the biggest single improvement.

Is a link with a password on it suspicious?

Not inherently — password protection is a legitimate feature for links that should only reach specific people. But it does mean the recipient cannot verify the destination in advance, so it should be used between people who already trust each other, with an explanation of what the link is.

What does it mean if a short link resolves to another short link?

Chained shorteners are a strong warning sign. There is almost no legitimate reason to point one short link at another, and doing so is a standard technique for defeating automated link checking. Treat a chain as a reason to stop.

How do I read an expanded URL safely?

Find the last dotted name immediately before the first single slash — that is the real domain. Anything to the left of it, including a convincing brand name, can be set to whatever the attacker wants. yourbank.com.secure-login.example.net is example.net.