Shortened URLs Not As Risky As Once Thought
By wchung | 20 Apr, 2025

Link-shortening services such as TinyURL seem ideal for criminals because they can disguise the names of malicious sites. Yet on Twitter — one of the most popular places for them — they may not be nearly as malicious as many industry experts fear, according to new security research.

Zscaler Inc., a company that sells security services, studied 1.3 million shortened links taken from Twitter over two weeks, before Twitter began in early March to examine such links for malicious content. Just 773 of those links — a mere 0.06 percent — led to malicious content.

Link-shortening services convert long Web addresses into shorter ones. They have become more popular as people spend more time on social-networking sites and share with their friends links to photos, news articles and other tidbits. They are especially important on Twitter, which restricts its posts to 140 characters.

Criminals can use them to trick people into visiting malicious sites because the links carry the names of the shortening services, such as Bit.ly or TinyURL, rather than the actual addresses of the sites.

Julien Sobrier, senior security researcher with Zscaler, said users seem to be paying more attention to such links because they know they are being taken elsewhere.

“Twitter’s shortened URLs (links) aren’t trusted by users,” he said. “You know the link you’re seeing is not where you’ll actually go.”

And if users are going to be suspicious, criminals have less incentive to use them.

Sobrier said the study shows that other sites, such as search engines, are more trusted because they’re considered more sophisticated at filtering the content they present. So criminals are better off manipulating search results to push their malicious links to the top of the rankings, he said.

It’s hard to get a sense of how many of the links overall on Twitter are harmful, and how many are ultimately blocked by Twitter and the link-shortening services.

Twitter and TinyURL representatives did not respond to messages for comment. Bit.ly would say only that the rate of malicious links Zscaler found is in line with Bit.ly’s own statistics.

Still, harmful content abounds from shortened links. Another research firm, ESET LLC, said last week that it found more than 1,000 malicious shortened links on Twitter that tried to infect people’s computers as they looked for information on the Moscow subway bombings.

JORDAN ROBERTSON, AP Technology Writer SAN FRANCISCO