Skip to main content
Search the index of shortened links — bit.ly, tinyurl, and the rest — to find ones that resolve to phishing pages or malicious payloads. Attackers lean on shorteners to hide a hostile destination behind a clean-looking link, so a match here tells you a short URL pointing at content tied to your brand or term is already in the wild. This is an async source: submit a search, poll until it finishes, then read the results.
1

Submit

POST your term to create_shortener_search_request. It returns a request object with an id and a status.
2

Poll

GET get_shortener_search_request/{id} with the id from the submit step. Repeat until status reports the job is finished.
3

Read

GET list_shortener_search_result, passing the request id as searchrequest. Page through the findings and narrow with the optional filters.
This source costs 0 credits per search and is throttled to 100 submissions per day.

​
Request parameters

Submit (create_shortener_search_request, JSON body): Read (list_shortener_search_result, query string):

​
What comes back

Submit and poll return the request object: id, your search_term, status, create_date, update_date, created_at, and monitoring flags (is_monitoring, alert_cycle, is_email, is_reporting, report_id, follow_up_token). Watch status to know when results are ready. Read returns a paginated envelope. Top-level fields:
  • count — results on this page.
  • total_count — total results across all pages.
  • next / previous — page cursors, null at the ends.
  • available_extensions — every file extension present in this result set, for building the extension filter.
  • available_shortened_domains — every shortener hostname present, for building the shortened_domain filter.
  • results — the array of matches.
Each entry in results carries:
  • id — result identifier.
  • link — the destination URL the short link resolves to.
  • domain — the destination’s domain.
  • shortener — the full short URL itself.
  • shortener_hostname — the shortener service host, e.g. bit.ly.
  • extension — file extension of the destination, when there is one.
  • size — destination file size in bytes; may be null.
  • appeared_date — date the link first appeared (YYYY-MM-DD).
  • discovered_date — timestamp the link was indexed (YYYY-MM-DDTHH:MM:SSZ).
  • searchrequest — the request id this result belongs to.
Treat any short link resolving to a lookalike of your domain (here login-acme.com standing in for acme.com) as an active phishing lure. Pull the shortener URL for takedown with the shortener provider, and feed the destination domain and link into your blocklists and user-awareness alerts.

​
What to do with the results

Each match is a live short link pointing at content tied to your term — usually a phishing page or a malicious file. Submit the shortener URLs for takedown and block the resolved domain and link across your mail and web gateways before users click through.