Friday, March 3, 2023

Phishing scams using URL Shorteners

I am sure many of you are familiar with shortened URLs that redirect you to a different long-winded URL when clicked. If you’ve ever seen or used tinyurl.com, or a bit.ly link, you are already familiar with how they work. 

These shorturl services like bit.ly etc., have been abused by scammers for their phishing campaign for a while now. Recently, there is an increased use of these technique specifically leveraging reputable/legitimate websites like linkedin.com (see link below) since malware protection software and spam blockers are unlikely to block these short links created by reputable organizations like LinkedIn.

https://www.malwarebytes.com/blog/news/2023/02/linkedin-slinks-abused-to-phish-email-and-payment-details

So how do you know if your given short URL is not going to take you to a shady phishing site or worse, to a malware laced website? Essentially, what you need is an inverse of shorturl i.e., longurl 😁 which expands the shorturl to show where it would take you if you were to click. That is exactly what I have done on this simple tool below. Feel free to use.

https://selvansoft.com/longurl/

Note: Try expanding this sample short link (https://bit.ly/3YuGbTA) using the longurl service above. For safety, the redirect address is checked w/ out actually traversing there and also it goes just one level deep only. There is also urlscan.io that does lot more if you want to try that as well. 

PS: I also have a very simple shorturl service similar to bit.ly here  https://selvansoft.com/shorturl/ Again, feel free to use.

No comments: