URL Shorteners: the category built around a hidden destination
A short link tells you nothing about where it goes. That is convenient for marketing and dangerous for security. This page covers what the URL Shorteners category contains, how it is abused, and how filters decide what to do with it.
What the URL Shorteners category includes
The category holds domains whose main job is to turn long links into short ones and redirect visitors. It is about the redirect service, not the content behind it.
Public shorteners
Open services where anyone can paste a long link and get a short one, with or without an account.
Branded short domains
Short domains owned by a company, newspaper or public body and used only for its own links.
Platform shorteners
Short domains social and video platforms use to wrap links shared on their own services.
Dynamic QR redirects
Domains behind dynamic QR codes, which redirect a scan to a destination that can be changed later.
Deep link routers
Services that send a tap to the right app or store page depending on the device.
Self-hosted shorteners
Small shortening services run on their own domains by individuals or communities.
Link management tools
The short-link domains of tools that add click statistics and campaign tags for marketers.
Link rotators
Services that send each click to one of several destinations, used for testing and, often, for abuse.
Exclusions and neighbouring categories
Many things redirect. Only services built to shorten links belong here. The rest are labelled by their purpose.
Advertising/Marketing
CDN / Hosting / Infrastructure
The site's own category
Malware / Phishing / Suspicious
Social Networking or Blogs/Personal Sites
CDN / Hosting / Infrastructure
Web-based Applications
Parked / For-Sale Domains
Typical site types and what they look like
Most shortener domains have almost no content of their own. The home page is a paste box, a pricing page or nothing at all. These are the types you meet, with the labels they usually carry.
| Site type | What the domain shows | Usual labels |
|---|---|---|
| Large public shortener | Paste box, account plans, abuse report form | URL Shorteners |
| Company short domain | Redirects to the company site, no own home page | URL ShortenersBusiness |
| Government short domain | Links to official pages and services | URL ShortenersGovernment & Legal |
| Anonymous paste-and-go shortener | One input field, ads, no terms or contact | URL Shorteners |
| Paid-click shortener | Shows ads or a countdown before redirecting, pays link creators | URL ShortenersAdvertising/Marketing |
| Dynamic QR platform | QR designer on the main domain, redirects on a short domain | URL ShortenersWeb-based Applications |
| New shortener with no history | Registered days ago, used in a single campaign | URL ShortenersMalware / Phishing / Suspicious |
Check any short domain you meet in logs with the domain category lookup tool. It returns the full ranked label set, including any threat label.
Paid-click shorteners deserve attention. Their interstitial pages often carry aggressive ads and fake download buttons, which is why many school and family policies block them even when other shorteners are allowed.
Why shorteners are a security category
Short links are not harmful in themselves. They are a disguise, and attackers use disguises. These are the patterns security teams see most.
Phishing in email
A short link hides a lookalike login page. The reader cannot check the domain by hovering, because the hover shows the shortener.
SMS and chat scams
Text messages have little room and no link preview, so short links are the norm in delivery and bank impersonation scams.
QR code phishing
A printed or emailed QR code leads to a redirect, then to a fake page. Scanning on a phone often bypasses desktop protections.
Malware delivery
Short links point to file downloads on throwaway hosts, and can be switched to a new host when the old one is blocked.
Cloaking
Rotators and conditional redirects show a harmless page to scanners and a malicious one to real victims.
Filter evasion
Users share short links to blocked content, hoping the filter only checks the first domain.
Nested shorteners
One short link points to another, sometimes several times, so a quick check of the first hop learns nothing useful.
Dead service takeover
When a shortener shuts down, its domain can be re-registered. Old links in documents and posts then lead wherever the new owner wants.
Executive impersonation
A short link in a message from a "manager" points to a fake document sign-in page, timed for the end of the working day.
The defence is not to fear the short domain but to judge the destination. Our phishing and malware domain feed page explains how the threat categories catch what sits behind the redirect.
Risk tiers inside the category
Not all shorteners are equal. Policy works best when it treats them in tiers, from owned brand domains to anonymous new services.
Branded short domains
Used by one organisation for its own links. Destinations stay on that organisation's sites.
Established public shorteners
Large services with abuse reporting and link takedowns, but open to anyone.
Anonymous free shorteners
No account, no visible abuse handling, often popular with spam campaigns.
New or abused shortener domains
Recently registered redirect services, or domains mostly used for abuse.
A domain can move between tiers. A public shortener that loses control of abuse can gain a threat label at its next refresh, and a branded domain that lapses can become parked. Monthly refreshes of every domain catch these shifts.
Tiers are a policy choice built on top of the category. The data gives you the URL Shorteners label plus any threat labels on the same domain, ranked; your product decides where each tier starts.
How filters handle a short link
Each layer sees a short link differently. Knowing what each one can see explains why category data is needed at more than one point.
lookup short.example URL Shorteners → allow
# 2. shortener answers with a redirect
follow login-check.example (newly registered)
# 3. destination is checked on its own
lookup login-check.example Malware / Phishing / Suspicious → block
DNS filter
Sees the shortener lookup, then the destination lookup. It can block the destination even when the shortener is allowed.
Web gateway
Sees full URLs when traffic is inspected, and can follow redirects to decide on the final page.
Email security
Expands short links in messages before delivery or at click time, then checks each hop.
Browser or agent
Checks each navigation on the device, which also covers QR scans on managed phones.
Because the destination check matters most, freshness matters most. About 300,000 newly registered domains are categorized every day and checked again after a week and a month, which is exactly where short-link campaigns tend to land.
Policy table: schools, businesses, guest Wi-Fi, parental control
The common pattern: allow the category, block what sits behind it when the destination is unsafe, and tighten in high-security settings.
| Environment | Typical setting | Why | Extra controls |
|---|---|---|---|
| Schools (CIPA) | Allow established shorteners; block anonymous ones | Teachers share short links in class. CIPA requires blocking harmful images wherever they are, so the destination check does the real work. | Make sure the filter evaluates the destination; block VPN / Proxy / Anonymizers behind short links |
| Businesses | Allow, judge destination | Short links appear in newsletters, social posts and partner mail. | Expand links at the email gateway; log clicks on new shortener domains |
| High-security networks | Block public shorteners; allow-list branded domains | Hidden destinations conflict with strict egress policy. | Show users a page that explains how to request the full link |
| Guest Wi-Fi | Allow | Guests scan QR menus and posters all day. | Block threat categories at DNS so bad destinations fail |
| Parental control | Allow, judge destination | Children meet short links in games, videos and chats. | Block Adult and threat categories at any rank; alert on blocked destinations |
Multi-category cases
Domains carry several categories, ranked by how much of the site each one describes. For shorteners, the extra labels say who owns the domain or how it is used.
| Case | Labels | Policy effect |
|---|---|---|
| Newspaper's branded short domain | URL ShortenersNews/Media | Allowed with News/Media rules |
| Social platform's link wrapper | URL ShortenersSocial Networking | Follows your social media policy, see social media filtering |
| Shortener heavily used by spam | URL ShortenersMalware / Phishing / Suspicious | Blocked by security policy at any rank |
| Marketing link tool with analytics | URL ShortenersAdvertising/Marketing | Allowed in most offices; some ad blockers act on it |
| Dynamic QR service | URL ShortenersWeb-based Applications | Allowed; destination check applies |
| Retired shortener, now parked | Parked / For-Sale Domains | Old links stop resolving to their content; often blocked |
How vendors use the URL Shorteners category
Security products use the label as a trigger: when a link is short, do more work before trusting it.
Email security
Expand every link on a shortener domain and check the final destination before delivery or at click time.
Mobile operators
Flag SMS containing shortener links for extra scrutiny in scam filtering.
DNS filters
Allow established shorteners, block anonymous and new ones, and rely on the destination lookup for the rest.
Secure web gateways
Follow redirect chains and apply policy to the final URL, logging the shortener for investigations.
Browser extensions
Show users the real destination and its category before they click a short link.
Threat intelligence
Enrich alerts so analysts see when an incident started from a short link.
Each of these needs the shortener list and the threat categories in one consistent source. The web filtering database delivers both, as files that run in your own systems, with a lookup API included for licensed customers.
Building shortener handling into a product
A practical checklist for teams adding short-link logic to a filter, email gateway or browser tool.
URL Shorteners FAQ
Why are URL shorteners a security concern?
A short link hides its destination until it is opened. Attackers use that to send people to phishing pages or malware, and to slip known bad domains past people and simple filters that only see the short domain.
Should I block all URL shorteners?
Most organisations do not, because legitimate short links are everywhere. A common approach is to allow established shorteners, judge each link by its final destination, and block anonymous or newly registered shortening services.
Does a DNS filter see where a short link goes?
Indirectly. The browser first resolves the shortener domain, then follows the redirect and resolves the destination domain. A DNS filter can block the destination at that second lookup.
Are branded short domains in this category?
Yes, when the domain exists to shorten links for one organisation. They usually carry URL Shorteners plus the brand's own category and are generally lower risk than open public shorteners.
What happens when a shortener domain is used mainly for abuse?
It carries Malware / Phishing / Suspicious as well as, or instead of, URL Shorteners, so security policies block it at every rank.
Can students use short links to reach blocked sites?
Only if the filter checks the first domain alone. Filters that evaluate the destination, at DNS or at the gateway, block the blocked site whatever link was used to reach it.
Are QR codes covered by this category?
A QR code is just a link. Static codes point straight to a destination and take its category. Dynamic codes go through a redirect domain, which carries URL Shorteners, and the destination is then judged on its own.
What should users do with a short link they do not trust?
Many shorteners offer a preview page that shows the destination before redirecting. Inside organisations, the simplest rule is to report the message rather than test the link.
How is this category licensed?
As part of the full database for internal use or OEM embedding. Starter database tiers start from $999; enterprise and OEM licences are quoted per deployment.
See past the short link
URL Shorteners and the threat categories behind them, across 120 million categorized domains, with daily files for newly registered domains. Tell us what you are building.