URLs play a surprisingly important role in criminal investigations. Short URL click logs, phishing site domain registration data, and browser history URLs have all served as decisive evidence leading to arrests.
In a 2016 US fraud case, click logs from a Bitly short URL became the critical evidence. The criminal embedded Bitly links in phishing emails to steal banking credentials. However, Bitly's logs recorded every clicker's IP address, access time, and browser information. The FBI obtained this data via warrant and identified the criminal's home address from an IP logged when the criminal tested their own link.
Europol traced criminal organizations through phishing domain WHOIS data in 2019, discovering hundreds of domains registered with identical information, leading to 11 arrests. While GDPR has made much WHOIS data private, law enforcement can still obtain registrant information via warrant. Crime investigation books are available on Amazon.
Browser history URLs are increasingly accepted as court evidence. In corporate internal investigations, employee browser histories prove unauthorized data transfers or improper competitor communications.
Security researchers analyze malware distribution networks by tracing redirect chains through multiple short URLs. In 2020, Google's Threat Analysis Group decoded redirect chains used by North Korean hackers, revealing their entire attack infrastructure. URLs are convenient tools for criminals but also treasure troves of evidence for investigators.