Check short url

CheckShortURL (checkshorturl.com) is a URL expansion tool that reveals the final destination URL behind shortened links from services like bit.ly, TinyURL, goo.gl, and hundreds of other URL shortening services, without loading the destination page.

For OSINT investigators, URL expansion is an essential operational security practice before following any unfamiliar shortened URL. Shortened URLs completely obscure the destination — they can lead to malware distribution sites, phishing pages, inappropriate content, or surveillance infrastructure that logs visiting IPs. Expanding the URL before following it reveals the actual destination for assessment.

Phishing campaign investigation frequently encounters shortened URLs in phishing emails and messages. Expanding these links reveals the phishing domain and landing page URL, which can then be analyzed through URL scanning tools (VirusTotal, URLScan, URLVoid) before any browser interaction.

Social media investigation often surfaces shortened URLs shared in posts, profile bios, or direct messages. Expanding these before following identifies whether the destination is legitimate or suspicious.

Threat intelligence analysis of malware samples, phishing kits, or attacker communications frequently contains shortened URLs used to obfuscate infrastructure. Expansion is a critical first step before any further analysis of discovered links.

CheckShortURL expands URLs through multiple hops — some URL shorteners redirect through intermediate URLs before reaching the final destination, and CheckShortURL follows the complete redirect chain to show the true endpoint.

The tool does not load the destination page — it only reveals the URL — making it safe to process potentially malicious shortened links without exposing the investigation environment to the destination content.

Document all shortened URLs investigated, the expansion tool used, the revealed full URL, and whether the destination was subsequently analyzed through URL reputation tools.