This helps them keep track of clicks for analytics purposes, but also means that any page indexed by Google actually generates a redirect link from Google’s own domain, which could be used for phishing.

Every link you see in a search result page is actually a redirect from Google that looks something like this: Google search has a variant of this issue. This can help companies keep track of important data, but becomes a security issue when anyone can leverage a redirect to create a link to any page on the web.įor example, a scammer could exploit your trust of to create a link that actually sends you to : Websites often have a need to redirect users to some other site (or a different page on the same site) without using a regular link. These “legitimate” URLs are extremely useful to email scammers because they are more likely to bypass filters or escape the notice of victims.

Certain types of vulnerabilities allow for leveraging a site’s domain to create a URL that seems to originate from the site’s page, but is actually under the control of the hacker.

Attention advanced mac cleaner