How to track shortened URLs?

What are shortened links?

Shortened links are URLs that have been condensed into a shorter format. This is typically achieved through URL shortening services such as Bitly, TinyURL, or goo.gl. These services take a long URL and convert it into a short, manageable link that redirects to the original address.

Why are shortened URLs used?

Shortened URLs are used for several reasons. They offer convenience as they are easier to share, particularly on platforms with character limits such as Twitter. They also enhance aesthetics, providing a cleaner and more professional appearance in communications. Additionally, URL shortening services often come with tracking and analytics features, allowing users to monitor the number of clicks, the geographical location of the clicks, and other data.

The role of shortened links in OSINT

In OSINT, shortened links can be a treasure trove of information. Cybersecurity analysts and investigators often encounter these links in various contexts, such as social media posts, emails, forums, and more. By analyzing these links, investigators can gain insights into user behavior, identify potential threats, and uncover hidden connections.

Investigators can trace the original sources of information or communications and identify patterns in behavior or information dissemination. Additionally, OSINT can help unmask malicious links that are often disguised using shortened URLs, thus protecting against cyber threats.

How to track shortened URLs

Tracking shortened links involves several steps and tools. Here’s a step-by-step guide:

Unshortening the link

The first step is to reveal the original URL behind the shortened link. This can be done using unshortening services like CheckShortURL, Unshorten.It, or directly through some URL shortening service providers that offer preview options.

CheckShortURL: This tool allows you to see the full URL and its safety status.
Unshorten.It: Another service that reveals the original URL along with a screenshot of the destination page.
Manual method: For some URL shortening services, you can simply add a "+" at the end of the shortened URL to see more details. For example, adding "+" to a Bitly or goo.gl link (https://bit.ly/3SDO9ZM+) will show you the original URL and analytics data if available. For TinyURL, type "preview": https://preview.tinyurl.com/.

Analyzing the original URL and gathering metadata

Once the original URL is revealed, it can be analyzed for further information. This may involve looking at the domain, checking for known malicious activity, or seeing if the URL leads to a suspicious or unexpected site. Tools like URLscan.io, VirusTotal, and WHOIS lookups can provide valuable metadata about the domain, such as the registrar, registration date, associated IP addresses, and any reported malicious activity.

WHOIS lookup: Use WHOIS services to find out who registered the domain and their contact information.
Website analytics tools: Tools like SimilarWeb or Alexa can provide insights into the website’s traffic and engagement.
Social media analysis: Look for mentions of the URL on social media platforms to understand its spread and impact.