Shortened URLs – those funny looking combinations of random characters that you often see around the web (for example http://bit.ly/bAYYYO). They are very useful, for example, if there is a limit to the number of characters, such as on Twitter or some instant messaging services, or if a link would otherwise be annoyingly long. Unfortunately, they also pose a security threat.
We recently completed an analysis of reputations of nearly 1.7 billion shortened URL links. You can read about the findings in the press release, but here is the summary:
Because shortened URLs hide the identity of web pages they lead to, they are a tempting tool for driving traffic to suspicious websites. Our research found that 8.7 % of websites reached via TinyURL service, and 5.0 % via Bit.ly, receive a poor rating for ‘trustworthiness’ and ‘child safety’.
Many of those links lead to loosely-regulated countries where as much as 90 percent of the websites are suspicious.
The top five most exploited domains are:
- .ac (Ascension Island) – 91% of websites are rated poorly
- .ms (Montserrat) – 65% of websites are rated poorly
- .pr (Puerto Rico) – 46% of websites are rated poorly
- .mu (Mauritius) – 36% of websites are rated poorly
- .tc (Turks and Caicos Islands) – 35% of websites are rated poorly
They sound like perfect holiday destinations, but you might not want to click a link that points there!
What should you do when you encounter a shortened URL?
No matter if a URL is shortened, WOT shows you the reputation of the actual target page of the link: if the donut next to a shortened link is red, you might want to think twice before clicking it. If you click the donut it takes you to a scorecard, and there you can also check for more information before deciding if a shortened link is worth following.
Read more about WOT’s shortened URL analysis on the press release WOT Analysis: Are URL Shortening Services Unintentionally Promoting Malicious Websites?
Surf safe!
Edit:
Here are some articles written based on the analysis:
ThreatPost:Analysis Shows Some URL Shorteners Often Point to Untrusted Websites
Help Net Security: Analysis of nearly 1.7 billion shortened URL links
One Response