🔗
Link Shortener Phishing
Medium SeverityLink shorteners appear in 24% of phishing emails
Link shortener phishing uses URL shortening services (bit.ly, tinyurl, etc.) to disguise malicious destination URLs in phishing emails, making it impossible to see where a link actually leads.
How it works
- Attacker creates a phishing page on a compromised or lookalike domain
- The malicious URL is shortened using bit.ly, tinyurl, or similar services
- The shortened link is embedded in an email that appears legitimate
- Victims can't see the real destination by hovering over the link
Red flags to watch for
- Shortened URLs in emails from banks, tech companies, or employers
- Legitimate companies rarely use URL shorteners in official emails
- Use a URL expander tool to preview shortened links before clicking
Real-world example
Subject: Your package delivery failed — reschedule now
From: delivery-notification@fedx-updates.com
“We attempted to deliver your package but no one was available. Reschedule your delivery: https://bit.ly/3xR4kMz”
How to protect yourself
- Never click shortened URLs in unexpected emails
- Use URL preview tools (checkshorturl.com) to see the real destination
- SiftMail automatically detects and scores link shorteners in email bodies
How SiftMail detects this
SiftMail adds +15% to the risk score when link shorteners are detected in the email body, as legitimate senders rarely use them.
Spot link shortener phishing the moment they land
SiftMail scores every email after delivery and labels the risky ones. Preview what it found, confirm, and archive in one pass. Free plan available, setup takes 30 seconds.