Following a minimal page through its redirect chain

A minimal “Click here to proceed” page may look harmless, but its usefulness depends on what sits behind the link. A single visible button can trigger several server requests, regional or consent pages, tracking parameters and a final destination on another domain. The first page is therefore evidence, not necessarily the destination.

Tracing the route means reconstructing each hop in order and noting why it occurs. Some hops are ordinary HTTP redirects; others are created by JavaScript, a meta refresh or a click handler. Following only the final address loses the intermediate context that can reveal advertising, affiliate tracking, aggressive geographic routing or a compromised intermediary.

That context matters in Australia, where people often tap links embedded in texts, social posts, QR codes on café menus and public transport signs, or emails from banks and ticket providers. On a phone, a redirect can be easy to miss because it may pass through an app-store, privacy or campaign page before opening a browser. A destination can also vary by device, age gate and location.

Start passively: copy the visible address without opening it, note the time and device, then inspect headers before interacting. Record UTC as well as local time because Sydney and Melbourne change between AEST and AEDT, while Brisbane and Perth do not observe daylight saving. If personal information appears, remember that the Privacy Act 1988 and Australian Privacy Principles may apply to the organisation handling it.

Find the first recorded hop

Begin with the page source rather than the button itself. In a browser, choose “View source” or open developer tools and inspect the link’s href attribute. If the button has no ordinary address, look for an onclick handler or JavaScript that assigns a location. Copying the link prevents an accidental visit while still revealing whether the first request is visible.

For a command-line check, use curl to follow redirects and print each response header:

curl -sS -L --max-redirs 10 -D - -o /dev/null \
  -w 'final=%{url_effective}\n' 'https://example.com'

The -D - option displays the headers, while the final line reports the effective destination. A server can respond differently to HEAD and GET, so confirm unusual results with a GET. Only contact addresses you trust, since even a harmless-looking request reveals your IP address to the redirect operator.

For a controlled rehearsal, the redirect service can provide the kind of first page you would inspect, although you should verify what it actually serves before relying on it. The important step is recording the complete response sequence rather than judging the page by its appearance.

Read the redirect headers

HTTP status codes reveal the purpose of each server-level hop. A 301 or 308 normally indicates a permanent move and may be cached more aggressively. A 302 or 303 generally signals a temporary redirect, while 307 and 308 preserve the original request method. The accompanying Location header identifies the next URL, which may be absolute or relative.

Read every Location value rather than only the last one. Inspect added query strings for campaign identifiers, affiliate codes or tracking parameters. Note whether the hostname changes at each stage and whether the path moves through an account, consent or localisation gateway. A loop usually ends with curl’s maximum-redirect error, while a chain with too many legitimate stages can look similar, so the status sequence matters.

Redirects also operate inside messaging platforms. This weather bot guide illustrates how a bot can publish links that people open on their phones. The guide is not a redirect audit, but it demonstrates why a link appearing in a familiar chat or bot interface should still be expanded and checked before its destination is trusted.

Follow browser-only redirects

Curl does not execute JavaScript, so it can stop where a normal browser continues. In developer tools, open the Network panel, enable “Preserve log”, clear existing entries and then activate the button. This shows requests created by scripts, delayed page loads, tracking pixels and redirects that happen after an initial page appears.

Meta-refresh instructions and scripts that call window.location are common browser-only mechanisms. Disabling JavaScript may prevent the chain from progressing, while running it can trigger the next request, so use an isolated browser profile and avoid entering credentials or downloading anything. Compare the network log with the HTML source to determine which requests belonged to the original publisher and which came from third parties.

DNS and TLS records provide supporting information but do not establish trust. dig can show a domain’s nameservers and current address, while dig +trace helps identify where resolution occurs. Certificate details can expose related infrastructure, although shared hosting makes them inconclusive. Australian .au domains also have eligibility and registration rules, and some details may not be publicly displayed.

Even an address such as the linked test page should be treated as an unverified hop, not as evidence of the original publisher’s identity. Compare its hostname, registration information and certificate with the organisation you expected. If the chain has moved into an unfamiliar country domain without explanation, pause before interacting with it.

Check ownership, safety and privacy

Assess the final destination independently of the minimal page that led to it. Look for spelling errors, unexpected subdomains, punycode, requests for payment, password entry or urgent security messages. Tools such as Google Safe Browsing and Microsoft SmartScreen can help identify known deceptive pages. VirusTotal can also reveal historical reports, but submitted URLs may become part of its sharing system, so do not upload private, authenticated or confidential links.

Australian banks, supermarkets, airlines and ticketing platforms often use redirect gateways for campaigns, regional content and account journeys. Those routes can be legitimate, but a familiar brand in the first page does not guarantee that the next page is genuine. Check whether the domain is one you would expect for that organisation and whether a security warning appears in a separate browser.

If the route collects personal information, consider the Privacy Act 1988 and the Australian Privacy Principles, including transparency, collection limitation and security obligations for covered organisations. Do not place real customer details into a test form. For unsolicited commercial email or SMS, the Spam Act 2003 may also be relevant because consent, sender identification and a working unsubscribe mechanism can be legally required.

Keep evidence when a route appears deceptive: the original URL, redirect headers, final destination, timestamps and screenshots. ACCC Scamwatch provides Australian reporting guidance for scams and suspicious online activity. Reporting a redirect can help protect other customers, especially when it uses convincing branding or creates a false sense that the request came from a trusted local business.

Record results and act safely

Document every confirmed hop with its timestamp, status code, Location value, destination hostname and the device used. Include whether the step was automatic or required a click, and note any JavaScript behaviour. A simple chronological record is more useful than a list of unrelated domains because it shows how tracking parameters and trust signals evolve across the journey.

Repeat important checks with a clean session and compare the results. A route may change according to location, browser, logged-in state or campaign. Include the local time and UTC offset in your notes, particularly when comparing a Sydney or Melbourne observation with evidence supplied by an Australian hosting provider. This can help distinguish genuine regional routing from a stale or forged timestamp.

For the final rehearsal, begin at the redirect testing menu in an isolated browser session and treat whatever appears as an unknown first hop. Copy the address, follow the headers one stage at a time, separate HTTP redirects from browser actions and verify the final domain before interacting. Save the completed route with your timestamps and report any deceptive destination to the relevant provider or ACCC Scamwatch.