undefined | Better HN

0 pointsscandox4y ago0 comments

A link shortener is a simple way for malicious or spammy email senders to cloak their malicious or spammy link in something which is not yet on a block list.

So what we find is that as new ones come into the market they are eagerly adopted and we start to see evil links. From our point of view the earlier we put in place a wholesale block the better, because otherwise they may become "too big to block" like bit.ly etc... Although even these are blocked by gmail from time to time (for example).

0 comments

2 comments · 1 top-level

cillian644y ago· 1 in thread

If security software can read email enough to observe the shortened URL, couldn’t it just see what it expands to and then judge the target URL? Link shorteners don’t seem to have any obvious CAPTCHAs.

scandoxOP4y ago

We have about 500ms to make our assessment so we wouldn't follow a link in realtime and depend on it resolving and redirecting etc.

Instead we expand them later and visit and scan them after the fact. But at that point the email is often already delivered.

But bottom line url shorteners are so abused as to be a de facto sign of spam.

j / k navigate · click thread line to collapse