Back to Checks
googleworkspace

Identification of links behind shortened URLs is enabled

gmail_shortener_scanning_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Gmail can identify and expand links behind shortened URLs (e.g., bit.ly, goo.gl) to check if the destination is malicious. URL shorteners are commonly used in phishing campaigns to obscure the true destination of a link.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without shortened URL scanning, attackers can use URL shortening services to hide malicious destinations in phishing emails. Users cannot visually verify where the link leads, increasing the success rate of phishing and credential harvesting attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_shortener_scanning_enabled

Recommendation

Enable identification of links behind shortened URLs so that Gmail can expand and scan shortened links for malicious content before users interact with them.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Links and external images**
4Check **Identify links behind shortened URLs**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_shortener_scanning_enabled(Check):
    """Check that identification of links behind shortened URLs is enabled.

    This check verifies that Gmail is configured to expand and scan
    shortened URLs to identify potentially malicious destinations
    hidden behind URL shortening services.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            scanning_enabled = gmail_client.policies.enable_shortener_scanning

            if scanning_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Identification of links behind shortened URLs is enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif scanning_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Identification of links behind shortened URLs uses Google's "
                    f"secure default configuration (enabled) "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Identification of links behind shortened URLs is disabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Shortened URL scanning should be enabled to detect hidden malicious links."
                )

            findings.append(report)

        return findings

References