Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Unchecked Redirection + URL Shortener = Spam

February 03, 2011 - 2 min read
Recently, I found several legitimate sites, with bad coding practices,  used to redirect users to spam sites with the help of URL shorteners. Here is how the scam works:
  • The legitimate sites have a warning page for all links to external sites (i.e.
  • The warning page can be used to redirect users to any domain, including spam sites and malicious pages (i.e.
  •  Spammers use a URL shortener like to hide the long URL (i.e. redirects to which redirects users to
Most URL shorteners do some checks on the final URLs to prevent spammers from using their service. By using a legitimate intermediate site, the attackers prevent URL shortening services from checking the true final destination and therefore prevent blocking of the shortened link.

One example of such redirection pages is Change to any URL. I've seen this page used to redirect to the rogue pharmacy

The redirection is not done by the standard Meta refresh tag (meta http-equiv="refresh" content="6;url="), but by custom JavaScript. Even if the URL shortener was looking at the HTML content to figure out the final destination, it would very likely not haven seen the redirection to an external domain.


In addition to being used by spammers, includes a cross-site scripting vulnerability: the link can be used to execute any JavaScript. The screen shot below was taken for the URL;
Cross-Site scripting on

Unchecked redirections is yet another security flaw that developers need to keep in mind when developing a website. Having a website widely used for spam will likely get it blocked by Google Browsing and other security and spam denylists, preventing users to access any page on the website unless they dare ignore the scary warning message from their browser.

-- Julien
form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.