Google has adjusted the way some search-result links function, introducing redirects through an encoded Google URL rather than taking users directly to the listed site. This change undermines a common safety measure—hovering over a link to preview where it leads—one that many relied on to notice malicious or misleading destinations. 👀
The updated redirects employ URLs following the pattern “google.com/goto?url=…” where the destination is encoded rather than shown plainly in browser previews. Security analysts observed this shift and warn it reduces the transparency users once had when deciding whether a link was legitimate. The visual label shown in the search results still displays the destination name, but hovering no longer reliably reveals the actual URL. That difference matters when scammers exploit search results or ads to mimic trusted sites. Several recent campaigns have used hijacked Google Ads or poisoned search listings to lead users to clone websites or malicious installers disguised as official software.
While Google has acknowledged that it implements technical defenses to combat abuse, the company has not clarified why this specific redirect change was made. The change notably complicates automated tools like scrapers, archiving services, rank trackers, and security audit platforms, because these tools must now resolve every redirect to see the final destination—adding load, latency, and potential for rate-limiting. Moreover, for users and organizations, the obscured destination undermines a lightweight safety check that has been a pillar of safe browsing.
Risks and Mitigations
The risks associated with this shift are highest in contexts where users search for software downloads, account recovery, tech support, or any page involving sensitive credentials or payments. Spoofed or lookalike pages become much harder to spot when link previews conceal the actual landing page. Researchers have cited recent examples, such as a fake Node.js installer campaign delivered through Google-sponsored results, that attempted to install infostealer malware on Windows machines after redirecting users through such ads.
To protect themselves, users are encouraged to confirm high-stakes links by typing known URLs directly, using bookmarks for trusted sites, or navigating from verified profiles rather than via search results or ads. Organizations should update guidance to stress that link hovering can’t always be trusted, and high-risk links should be double-checked through alternative sources. For researchers and tools that rely on bulk resolution of destination URLs, extra resources or adjustments may be necessary.
In sum, Google’s redirect change reduces transparency in search interactions. It may be defensible as part of a larger strategy to reduce automated abuse, but it erodes a once-reliable method users had for assessing risk. As search remains a gateway to many critical services, this development deserves attention from security professionals and everyday users alike.
Why this matters: when trusted-looking links hide their true destinations, phishing, malware, and fraud become harder to detect in everyday browsing. Users lose a valuable, passive safety check; tools lose fidelity in destination tracking. The broader trend points toward a safer Internet technically, but one where individuals must stay more alert than ever—especially when a single misclick could compromise identity or security. Watch for changes in how Google explains or justifies this rollout, any updates to browser behavior (like preview tools), and how the security industry adapts best practices in response.
