Link Wrappers, Rewriters and Shorteners

Overview

The URL someone received is often not where it leads. Several kinds of service put their own host in front of the real destination:

• Security wrappers and URL rewriters. Email and web security services rewrite links so that every click passes through them first.
• Shorteners. A short link stands in for a longer URL.
• Click-tracking redirectors. Mailing and marketing platforms route clicks through their own host to count them.

There are many of each, and new ones appear all the time, so recognize the class by its shape rather than by a list of names:

• a service host followed by the real URL, encoded in the query string (usually percent-encoded) or in the path; or
• a service host followed by an opaque token that only that service can resolve.

Find the destination

• When the destination is visible in the URL, decode it and investigate that. The wrapping host is not the target.
• When the link carries only a token, the destination cannot be determined from the link alone. Say so; never guess it.
• Resolving a token means following the link. That request can be recorded as a click by the recipient. Don’t submit a wrapped or shortened URL to a scrape tool just to see where it goes unless the user asks for it.

Who put it there

• A security wrapper is added in transit by a mail- or web-security service, normally the recipient’s own. A forwarded or replied-to message can carry wrappers added at earlier hops. Either way it identifies a filter, never the sender.
• A shortener or click-tracking redirector is put there by whoever wrote or sent the message, or by their mailing platform. It reflects their tooling and says nothing about the destination.
• Other parameters in a wrapped URL, such as recipient or tenant identifiers and signatures, describe the delivery, not the sender.

What it does not mean

• A wrapper is not a verdict. A security wrapper means the service will check the link when it is clicked. It does not mean the link is safe.
• A missing wrapper is not evidence. Organizations exempt links from rewriting, or check links at click time without rewriting them.
• A shortener is not a red flag by itself. Legitimate senders use them. It only hides the destination, which is why the destination has to be found.