## TL;DR
Scanners that stop at the first hop score the shortener, which is usually clean, and never see the harvest page. Check your gateway setting for redirect following depth and time-of-click protection, which re-checks the final URL when the user clicks. Then test with a multi-hop chain you control to prove the scanner reaches the end.

```text
filter's final-url resolution failed on url shortener redirect chain
```

## Use this when
- Phish links use shorteners or multiple redirects and arrive with a clean verdict.
- Scanner logs show a verdict for the shortener domain only.

## Not for this skill when
- The final page itself is judged clean by detonation. That is a sandbox detection miss.
- The shortener domain itself is malicious and blocked. No chain problem exists.

## Steps
1. Rebuild the redirect chain from a sample using a safe resolver, recording every hop to the final page. Verify: the full chain is documented.
2. Check gateway settings for redirect following, detonation of final URLs and the maximum hops or time allowed. Verify: current limits are known.
3. Enable time-of-click URL protection so the final destination is re-evaluated when clicked, even if delivery-time analysis stopped early. Verify: time-of-click is on for the affected users.
4. Raise redirect depth or add known shortener domains to a follow-and-detonate category where the platform supports it. Verify: the setting change is saved and scoped.
5. Send a controlled test chain ending at a known test-malicious page. Verify: the verdict names the final page and the click is blocked.

## Variant phrasings
### url shortener redirect chain phishing scanner follow
The chain-following variant.
### time of click protection redirect final url verdict
The time-of-click variant.

Compatibility: Defender Safe Links time-of-click, gateway redirect-following settings in Proofpoint and Mimecast.

## Why it happens
Redirects are cheap and disposable, so attackers stack them to keep the scored URL clean and to rotate final pages without resending mail. A scanner budget of a few hops or seconds is a known, probed limit.

## Edge cases / pitfalls
- Track final domains, not short links, as indicators; the short link is per-recipient noise.
- Some legitimate marketing mail chains through several trackers. Detonate rather than block chains outright.
- Log the full chain at delivery; after takedown the chain is your only record of the final host.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nmpA1mhsSaIorvxB-ep51Q