I haven't tested that but I think it's possible to modify the fragment with Javascript: https://stackoverflow.com/a/4282075
So my idea would be getting looo.ong to create a special client-side redirection webpage that would remove the fragment part using Javascript before performing the redirection with Javascript. And no. Using HTTP redirection response on server side won't work.
EDIT: I've actually seen URL redirection websites that removes the fragment part so it should be doable. Perhaps the purpose of that is to avoid spam abuse.
Yes, this is how single-page apps allowed linking to subpages before history.pushState existed.
What kind of penalty do you think you could've gotten and by whom?
You can imagine what your hosting provider or ISP will do with this.
Source: I ran a URL shortening service from 2004-2007 and this happened to me.
No one would shut down the post (DHL) for allowing a drug enterprise to send illegal substances using DHL.
So yeah, these links will be abused. What isn't abused?
The way how it worked is that the spammer used my urllengthener as a redirection service to a website that looks like an incomplete project, which is actually a disguise. There's javascript code on their site that if there's a URL fragment identifier (the hash thingie postfix for URL) detection mechanism and if the URL fragment identifier matches an ad of their own, it'd redirect to the actual spam ad.
Let's say the spammer owns example.org. The spammer would generate link with my service such that https://urllengthener.sadale.net/foobarbaz would redirect to https://example.org. Then it'd send spam with a link of https://urllengthener.sadale.net/foobarbaz#identifierXYZ to the victim. Then the victim would click on the link, which redirects him to https://example.org/#identifierXYZ, which would show victim the ad. https://example.org/ looks legit on its own and there is no log shown on the HTTP server because the URL fragment identifier is a client-side thing. I'm kind of thankful of that spam abuse report. Otherwise I might have never found out.
(Remarks: example.org isn't the actual spam site. I just use this domain name as an example.)
I don't have the time for now but I think I should make a write up about that some time later.
And I've tested your service and apparently your site is vulnerable for the exact same kind of abuse as mine. I'd strongly recommend you to at least disabling redirection of URL fragment identifier. Example of URL that's prone to abuse: https://looooooooooooooooooooooooooooooooooooooooooooooooooo...