Follow redirects from a bare page with command line tools
A nearly empty page with one generic proceed link can conceal several network requests. The browser will usually handle them without showing the intermediate addresses, leaving you unsure whether the link leads to the promised service or an advertising intermediary.
Redirects are not inherently suspicious. A short chain is routine in email campaigns, affiliate tracking, consent screens, and regional landing pages. The useful question is what each hop does, where the final page sits, and whether its identity matches what you expected.
Command line tools expose that trail. They can reveal HTTP status codes, Location headers, HTML refresh instructions, JavaScript redirects, and the final hostname without turning the link into a blind click.
Why a bare page may redirect
A minimal intermediary page may exist to record a click, apply regional rules, hide an affiliate identifier, or add tracking parameters before sending you onward. It may also be a parked domain or a stale link management page. With no organisation name, product description, contact route, or Australian business details, there is nothing on the surface to verify.
Some background on redirect persistence helps explain why certain chains keep returning to the same intermediary. That repeated host is worth investigating because it may be a gatekeeping layer rather than the site advertised in the email.
The visible link can also be misleading. A line of ordinary text may conceal a long destination, while the anchor might point to a different host from the one shown to the reader. Treating the first click as an inspection step is safer than assuming that plain English on the page proves who operates it.
Trace the complete HTTP redirect chain
An HTTP redirect is a response with a status such as 301, 302, 307, or 308 and a Location header. After saving the landing-page address in a quoted variable, the following command follows those responses, prints their headers, discards the bodies, and refuses to chase more than ten hops.
printf 'Paste the landing-page URL: '
read -r TARGET
curl -sS -L --max-redirs 10 --connect-timeout 10 --max-time 30 \
-D - -o /dev/null "$TARGET"
Read the output from top to bottom. Each status should be followed by its own Location; the last response has no redirect header. To print just the endpoint and status reached, run:
curl -sS -L --max-redirs 10 --connect-timeout 10 --max-time 30 \
-o /dev/null \
-w 'Final URL: %{url_effective}\nHTTP code: %{http_code}\n' "$TARGET"
A relative Location is resolved against the URL that returned it. A 200 confirms only that the final server returned a page, not that the destination is legitimate. Also, curl -I sends a HEAD request, and some servers answer that differently from a normal GET; use the full request when the result matters.
Use curl and wget for different views
curl is already available on macOS and most Linux systems, so it is a convenient default for following a chain. wget gives a similarly useful server-response view and can be clearer when you want to inspect each Location header without changing your habits.
wget --timeout=15 --tries=1 --max-redirect=10 \
--server-response -O /dev/null "$TARGET" 2>&1 |
grep -E 'HTTP/|Location:'
Set --max-redirect=0 to see the first response only, then increase the limit as needed. The 2>&1 portion is important because wget writes response diagnostics to standard error. In Windows PowerShell, invoke curl.exe, since curl may be an alias for a different cmdlet.
Neither tool makes a destination trustworthy. Their job is to make the route visible. Keep the original link, the list of hosts, and the final URL together, then judge the destination rather than the confidence of the redirector.
Find redirects embedded in page code
Some pages do not return an HTTP redirect. They contain a meta refresh, an ordinary anchor, or JavaScript that changes window.location after the HTML loads. Fetching the source lets you identify those mechanisms before your browser follows them.
curl -sS "$TARGET" |
tr '>' '>\n' |
grep -Ein 'meta[^>]+refresh|location\.href|location\.replace|location\.assign|window\.location|document\.location'
curl -sS "$TARGET" |
grep -Eio "href=['\"][^'\"]+['\"]"
The first command splits tags onto separate lines and searches for refresh or location patterns. The second exposes hyperlink targets that may have been hidden in styling. If neither finds anything, the destination may be assembled by obfuscated JavaScript or depend on a form submission; a browser’s Network panel with “Preserve log” enabled is the sensible next check.
A bare shell is not the same as a designed landing page. The page border examples provide a useful visual comparison when deciding whether you have reached an empty redirect wrapper or a page with meaningful content, branding, and navigation.
Run an Australian safety checklist
When an intermediary supplies no identity, research on uncertainty decisions can explain why the pause feels uncomfortable. Do not let that discomfort trigger an automatic click. First, record the chain:
Redirect signals
- Status code and
Locationfor every hop - Final hostname, scheme, and port
- Number of redirects and added query parameters
- Changes in domain or country code
Then assess the destination, not merely the transition. In plain Aussie shorthand, have a squiz at who controls it and whether it says what the original message promised.
Australian conditions add useful context. A .au or .com.au domain is reassuring but not conclusive: state namespaces such as .nsw.au and .vic.au sit within the Australian domain system, while legitimate Australian campaigns can also use .com, .net, or an overseas host. Some Australian retailers, travel sellers, finance providers, and classified marketplaces use campaign or affiliate tracking domains, so the first host may not be the merchant. Geotargeted pages can also vary between Sydney, Melbourne, Perth, and Darwin without identifying the actual sponsor. Check unusual destinations against guidance from Scamwatch, the Australian Cyber Security Centre, and eSafety, particularly if payment, banking details, or remote access is requested. Whether you use mobile data in regional Australia or an NBN home connection does not make the final host any safer.
Destination checks
- The registrable domain matches the organisation you expect
- A real Australian address, phone number, or business registration
- Security warnings and suspicious redirects are absent
- The offer, price, and terms match the original message
Make redirect checking a routine
A broader technical service overview can support a consistent process, but the essentials remain simple. Use curl to follow the HTTP chain, use source inspection for page-level redirects, and use wget when its response output suits you better. Save the final URL and hostname before opening the destination in a full browser session.
The strongest evidence is agreement across several checks: the final domain is plausible, the content matches the claimed organisation, and no suspicious parameters or credential requests appear. A valid TLS certificate proves encryption for that host, not honest ownership of the business.
Open a terminal now, set TARGET to the suspicious link, run the header and source checks, and record the final host before clicking through. If the route differs from what you expected, close it and reach the organisation through its established Australian website or app.
