How link shorteners and redirect chains hide where a link goes

How does an HTTP redirect work?#

A server answers a request with a 3xx status and a Location header; the client repeats the request at the new address. RFC 9110 separates permanent redirects (301, 308) from temporary ones (302, 307) and says 307 and 308 were added to preserve the request method, because clients had converged on changing POST to GET for 301 and 302 [1]. A client following a chain applies the same rule at each hop, so the first address shown to a user can be several requests away from the page they land on.

The RFC sets no mandatory hop limit. Real clients choose their own: StormDoor’s gate documentation puts curl’s default at 50 and most browsers at around 20 (we did not re-verify those figures), so the same chain can resolve in one tool and fail in another. StormDoor’s own cap is lower than both (see below).

Why does a plain HTTP client miss some redirects?#

Two redirect mechanisms live in the page, not in the headers:

• Meta refresh. The HTML Standard describes http-equiv="refresh" as a pragma that “acts as a timed redirect”, with a time in seconds and an optional URL [2].
• JavaScript. Location.assign() “causes the window to load and display the document at the URL specified” [3]. Any script can call it, including after a delay, a user-agent test or an IP test.

The server’s status for such a page is 200 OK. We checked this on loopback with three local pages served from our own machine: the HTTP 302 page returned status 302 with a redirect URL; the meta-refresh page and the JavaScript page both returned status 200 with no redirect URL.

A tool that only reads status codes therefore reports a one-hop, clean-looking chain for those pages. Only a tool that fetches the body and runs or parses it, usually a headless browser, follows them.

What is an open redirect?#

An open redirect is an application feature that sends users to a URL taken from a request parameter without validating it. OWASP gives the pattern http://example.com/example.php?url=http://malicious.example.com: the link begins on a trusted domain and ends elsewhere, and OWASP lists phishing as the main risk [4]. Its recommended fixes are to avoid redirects, map IDs to destinations on the server, or allowlist parsed scheme, host, port and path [4].

For a screening tool, an open redirect on a reputable domain is a hop that looks harmless. Reputation checks on the first domain pass; only the full chain reveals the destination.

Two illustrative chains, stepped one hop at a time (example domains, not captured traffic):

What do link shorteners add?#

A shortener maps a short code to a long URL and answers with a redirect, so the visible text never shows the destination. Their policies matter because they decide what happens when a short link is bad or old:

• Bitly says it calls its Abuse API while decoding a link to check whether the destination is malicious. A link in the “warn” category shows an interstitial with the long URL; in the “blocked” category the interstitial hides the long URL [6] (post dated 21 February 2023).
• Google’s goo.gl stopped accepting new URLs in 2018. Google announced on 18 July 2024 that goo.gl links would stop responding after 25 August 2025, then updated the post on 1 August 2025 to say only links with no recent activity would be deactivated and all others would keep working [5]. A short link is only as durable as its operator.

Chaining two shorteners puts the destination behind two operators, each of which sees only its own hop. StormDoor flags two or more distinct shortener services in one chain (link.shortener_chain).

How often do phishing emails use redirects?#

Abnormal AI, an email-security vendor, analysed nearly 800,000 email attacks across more than 4,600 organizations in the second half of 2025 and reported that 21.6% of phishing attacks used redirect links, with 10.2% of those relying on link shorteners. Abnormal calls redirect chains “a deliberate evasion technique” [7]. This is one vendor’s customer sample, published 29 April 2026, and the page gives no further method.

What do redirect chains look like on ordinary sites?#

We walked 23 public URLs one hop at a time with curl on 10 October 2026, recording the status code at each hop (method in the Method section). The first group is 17 well-known sites and shortener home pages requested over http://.

Of these 17, 3 had no redirect, 8 had one and 6 had two. The first hop was 301 in 12 cases and 302 in 2 cases. t.co answered 520 and reddit.com ended in 403 at the last hop, which we believe is bot filtering but did not verify; goo.gl ended in 400 on its root page. We did not create any shortener links.

The second group is httpbin.org’s documented /redirect/N endpoints, which return N redirects:

Two points follow. Ordinary sites chain two hops for http:// plus a www canonicalisation, so “more than one hop” alone is not suspicious. And /redirect/10 and /redirect/12 resolved in our 20-hop walk, yet would exceed a 10-fetch cap.

What does StormDoor’s links gate do, and what are its limits?#

POST /v1/links follows a URL’s redirect chain, then checks the final domain’s registration age and typosquat signals, and flags known shorteners (gate docs). You can try the same chain walk in the free redirect checker and the link checker. StormDoor makes both tools.

From the gate’s implementation and its documentation:

• Status codes only. It follows 301, 302, 303, 307 and 308 and never reads a page body. Meta-refresh and JavaScript redirects are not followed, so a chain that continues that way ends at the page that contains it. The gate also does no content scanning of the destination.
• 10 fetches. The cap is 10 hops. By our reading of the loop, a chain of up to 9 redirects resolves and one with 10 or more is cut off, which emits link.hop_cap_exceeded. We did not run this against a live chain.
• 8-second budget for the redirect-chain check.
• HEAD first. Each hop uses HEAD, falling back to GET only on 405 or 501. A server can answer HEAD and GET differently.
• Unsafe hops are refused. A redirect to a non-HTTP(S) scheme or a non-public host stops the walk and emits link.unsafe_redirect_target. The docs state this per-hop validation does not fully close DNS rebinding.
• One vantage point. The gate cannot see cloaking that depends on the visitor’s user agent, referrer or IP. Its docs note that long chains are a common cloaking technique.

A browser-based tool will catch JavaScript redirects that this gate misses; a status-code walker is faster and cheaper, and it will not execute attacker-controlled script.