A shortened link is a promise you cannot inspect. Somebody hands you eight characters after a slash and asks you to trust that the other end is what they say it is. Most of the time it is. The times it is not are exactly the times that matter.
This page expands the link for you. Scanify requests the address from its own servers, follows each redirect it is given, and shows you the entire path. Crucially, it never downloads the page itself, only the headers that say where to go next, so nothing on the destination gets a chance to run. If you ask for a picture of the page, Scanify opens it in its own sandbox and sends you the image, so your browser still never touches the link.
Why shorteners are a security problem
Link shorteners exist for good reasons: character limits, print materials, click analytics, tidy referral links. But the same mechanism that makes them useful makes them ideal for delivery of anything you would refuse if you could see it.
- They defeat visual inspection. The standard advice, hover and read the address, returns a shortener domain that tells you nothing about the destination.
- They borrow trust. A link on a well-known shortener inherits the shortener's reputation, not the destination's. Many corporate filters allow the big shorteners wholesale.
- They can change after the fact. Some services let the owner edit the destination after the link is shared. A link that was checked and cleared last week can point somewhere else today.
- They enable cloaking. A redirector can inspect who is asking and serve different destinations to a security scanner and a real person.
How to read the redirect chain
The chain Scanify shows you is the sequence of addresses the link walks through. Most legitimate links have zero or one hop. A few patterns deserve attention.
A long chain
Four or more hops is unusual for an honest link. Chains that long are typically affiliate laundering or an attempt to shake off scanners that only follow one or two redirects.
Crossing many different domains
A link that passes through three or more unrelated domains is being routed rather than simply forwarded. That is normal in advertising technology and abnormal in a message from a friend.
An HTTPS to HTTP step
If any hop drops from an encrypted connection to an unencrypted one, everything after that point is visible to anyone on the network path. Scanify flags this explicitly because it is both a privacy failure and a sign of a carelessly built scam page.
A destination that does not match the pitch
The most useful check is the simplest. If a message claims to be your bank and the chain ends on a domain that is not your bank's, the question is settled regardless of any other signal.
What the tool checks at the end of the chain
Revealing the destination is half the job. Scanify then checks that destination for the signals that separate a real site from a scam page: how old the domain is, whether the TLS certificate is valid and matches the hostname, whether Google Safe Browsing already knows about it, and whether the hostname is imitating a well-known brand through a lookalike spelling or a credential-bait word.
Which shorteners are supported
HTTP redirects from many services are supported. Scanify does not work from a list of known services; it follows whatever redirect the server returns, including bit.ly, tinyurl.com, t.co, goo.gl, ow.ly, buff.ly, is.gd, cutt.ly, rebrand.ly, lnkd.in, custom branded shorteners and one-off redirectors when those servers return an accessible redirect. JavaScript redirects, login walls and expired links may prevent expansion. It also unwraps the tracking wrappers that email systems add, so a link mangled by a corporate mail gateway still resolves to its true destination.
Safer habits around shortened links
- Copy, do not click. On desktop, right-click and copy the link address. On a phone, press and hold and choose Copy link address. Then paste it here.
- Be suspicious of shorteners in email. Legitimate businesses rarely shorten links in transactional mail. They have no character limit and every reason to show you their own domain.
- Treat a shortener in an SMS as hostile by default. Text-message scams about parcels, tolls and bank alerts are overwhelmingly built on shortened links.
- Re-check links that have been around a while. Because some destinations can be edited after publication, a link in an old post is worth re-expanding before use.
- Never sign in through a shortened link. If a page reached this way asks for credentials, leave and navigate to the service directly.
How the expansion works technically
Scanify issues a request for the address and reads only the response headers. When the server answers with a redirect status and a location header, Scanify records the new address and repeats, up to ten hops, within a shared five-second budget. The response body is discarded the moment it arrives, so no scripts, images or tracking pixels from any page in the chain are ever fetched. Requests that would resolve to a private or internal network address are refused outright.