miji.beLink previews are a feature where SNS and messaging apps display a preview of link content before users click, allowing them to grasp the destination's overview in advance. Platforms such as Facebook, X (formerly Twitter), LINE, Slack, and iMessage offer link previews, displaying titles, descriptions, and thumbnail images retrieved from OGP (Open Graph Protocol) meta tags. However, when combined with short URLs, this feature can create security risks. In a 2020 study, security researchers Talal Haj Bakry and Tommy Mysk showed that several major messaging apps transmit users' IP addresses to destination servers when generating link previews, raising privacy concerns. Because short URLs can conceal the final destination through redirects, they may be used for "preview spoofing" attacks, where the information displayed in previews differs from the actual destination. This article explains the technical mechanisms of link previews and systematically organizes security risks and countermeasures related to short URLs.
The link preview generation process can be broadly classified into three architectures depending on the platform. The first is the "sender-side generation" approach, where the sender's device accesses the link destination to retrieve OGP information and attaches the preview data to the message. iMessage and Signal adopt this approach. The second is the "server-side generation" approach, where the platform's servers access the link destination to retrieve OGP information. Facebook, X, and LinkedIn use this method. The third is the "receiver-side generation" approach, where the recipient's device accesses the link destination. This approach exposes the recipient's IP address to the destination, which poses a privacy risk. When short URLs are involved, preview generation requests first reach the short URL service's server, then are forwarded to the final destination through redirects. During this process, the short URL service can record the user agent of preview generation requests, identifying which platform generated the preview.
Preview spoofing attacks work by dynamically switching the short URL's redirect destination. The attacker first sets a legitimate website (such as a major news site article) as the short URL's redirect destination. When SNS or chat apps generate link previews, the legitimate site's OGP information (title, description, thumbnail) is retrieved, displaying a preview that looks like the legitimate site. After the preview is generated and cached, the attacker changes the redirect destination to a phishing site or malware distribution site. Users trust the legitimate site information displayed in the preview and click the link, but are actually directed to a malicious site. In phishing, short URLs that hide their destinations can be abused. This attack exploits the assumption that "I checked the preview, so it's safe."
Security measures on the short URL service side can be divided into several layers. First, there are mechanisms that record redirect destination change history and automatically flag short URLs whose destinations change repeatedly within short periods. Repeated changes of the redirect destination within a short time can be a clue for suspecting misuse. The second is a function that checks redirect destinations against Google Safe Browsing API or PhishTank databases and blocks redirects to known phishing or malware distribution sites. The third is a design that displays an interstitial page before redirecting, showing users the final destination URL. This intermediate page should display the destination domain name, SSL certificate status, and Google Safe Browsing verdict, enabling users to make informed decisions. Fourth, requiring CAPTCHA or email verification when creating short URLs can help curb bots from mass-generating malicious short URLs. Combining these measures makes it easier to reduce preview spoofing risks.
Users also have ways to defend themselves. First, rather than relying on link preview information alone, users can check final redirect destinations in advance with short URL expansion services (unshorten.me, CheckShortURL, etc.). Especially for messages containing links to financial institutions or login pages, manually typing the official site URL into the browser's address bar rather than clicking the short URL directly makes it easier to avoid being led to fake sites. One option for corporate security managers is to incorporate link preview spoofing examples into internal security training. The idea of checking links in emails before opening them can also be applied to links in chat apps. The convenience and security of short URLs involve a trade-off, and one approach is to combine technical measures with user education to keep risks down.