How We Keep a Free Link Shortener From Being Used for Phishing
Free short links attract abuse. The checks every Track Link destination goes through, why we hide visitor IP addresses, and what happens to a reported link.
· Written by the team that runs Track Link
Short answer
A short link is only as safe as the service behind it, because it hides where it goes. On Track Link, every link's destination is checked against Google's list of known phishing and malware sites when the link is made and whenever that destination changes, and reported links are reviewed and disabled. Before you tap a short link you don't trust, expand it to see where it really leads.
A short link has one job: stand in for a longer address. That's useful when you want a link that fits in a text message or on a poster. It's just as useful to someone who doesn't want you to see where a link really goes until it's too late.
Running a free link shortener means people try to misuse it. This is how we deal with that on Track Link: the checks every destination goes through, what happens to a reported link, a few things we refuse to build, and how you can check a short link yourself before you tap it.
Why free shorteners attract phishing
A phishing page wants two things: to look trustworthy, and to stay hidden until you've typed in a password. A short link helps with both. The real address is tucked out of sight, and the shortener's domain may be one that email filters and chat apps have learned to trust.
That's the uncomfortable part of running a shortener. Every abusive link made on it borrows the service's reputation, and every honest customer shares the cost when that reputation drops. So stopping abuse isn't only about protecting the people who click. It's also about keeping the links of everyone else working.
The time it happened to us
Every destination is checked before the link exists
When anyone creates a link on Track Link, we check where it points against Google Web Risk, Google's list of sites known for phishing, malware and unwanted software. We run the same check again whenever someone changes a link's destination, so a link can't be made clean and then quietly pointed somewhere bad.
If the destination matches, the link isn't created. The person making it sees a message saying the address can't be used because it was flagged as a potential phishing or fraud risk.
No list is complete. A brand-new phishing site may not be on Google's list yet on the day it goes up. That is why the check at creation is the first layer, not the only one.
Printed QR codes get checked again every day
A link in an email is usually clicked within days. A QR code printed on a poster, a menu or a parcel can be scanned for years, and the site behind it can change hands or get compromised long after it was printed. A check on the day the code was made isn't enough.
So every day, we re-check the destinations of QR links that were scanned in the past week. If one is now on Google's list, it goes to a person on our team to review. If you print QR codes yourself, our article on why QR codes stop working after you print them covers the other way they go wrong.
What happens to a link we take down
When we disable a link for abuse, it doesn't quietly forward visitors anyway, and it doesn't vanish into an error. Anyone who opens it lands on a page that says the link isn't available and why, for example because it was built to steal passwords or personal details. They are not sent to the destination. The page also tells them to change any password they may have typed after following the link before.
Taking down one link isn't much use if the same thing can be made again a minute later. When we take down a destination that Google's list doesn't know about yet, we block it on our side too, so it can't simply be recreated. And the account behind the abuse can be suspended.
| Safeguard | When it applies | What happens |
|---|---|---|
| Google Web Risk check | A link is created, or its destination changes | A flagged destination is refused |
| QR re-check | Every day, for QR links scanned in the past week | A flagged code goes to a person to review |
| Abuse reports | Someone reports a link | We review it; abusive links are disabled |
| Our own block list | We took a destination down by hand | It can't be used for a new link |
| Account review | Abuse traced back to an account | The account can be suspended |
Location links have extra rules
Track Link can also ask a visitor to share their precise location, which is a different kind of risk from phishing. A tool like that is only acceptable if it can't be used in secret, so the rules are built into the page itself:
- The visitor sees a screen saying who is asking (if the sender gave a name) and why, before anything is shared.
- Nothing precise is shared unless they tap share and then allow their browser's own permission prompt.
- Every one of those screens has a "Report this link" option.
- Covert tracking is against our terms. Reported links are reviewed, abusive ones are disabled, and the account can be suspended.
If you want to use location requests the right way, our guide on how to ask someone for their location explains what the visitor sees and how to ask so they say yes.
Why we don't show visitor IP addresses
Some link trackers show you the IP address of everyone who clicks. We deliberately don't. The dashboard shows when a link was opened, the approximate area, the device and the browser, which is what you need to understand your audience. It doesn't show the IP address.
An IP address is a step toward identifying a person, and a link tracker shouldn't be a tool for unmasking people. If you need to know where someone is, the honest route is to ask them, and a tracked link can't find someone from their phone number either, as we explain in can you track a phone number with a link?
How to check a short link before you tap it
None of the above means you should trust every short link. Here is what to do with one you're unsure about:
- Expand it first. Paste it into our URL expander or link tracer. Both show the final address, and the tracer lists every redirect on the way, without opening the page on your device.
- Read the final domain slowly. Look at the part just before the first single slash. A misspelled brand, an extra word, or an unfamiliar ending is a warning sign.
- Never sign in from a link you didn't expect. If a message says your bank, delivery company or email account needs attention, open the app or type the site address yourself.
- Report it. If a Track Link short link leads somewhere it shouldn't, our abuse page explains how to tell us. Include the full link and where you received it.
Questions people ask
Are short links safe to click?
A short link is as safe as the page it leads to, and you can't see that from the link itself. Expand it first with a URL expander, and be wary of any page that asks for a password or a payment.
How do I report a phishing link made with Track Link?
Our abuse page explains how to send us the link, and every location request has its own Report this link button. We look at every report and disable links that break our terms.
Does Track Link show the IP address of people who click?
No. The dashboard shows an approximate area, the device and the browser, but never the visitor's IP address. A link tracker shouldn't be a way to unmask people.
What happens if I open a link that was disabled?
You see a page saying the link was shut down and why, and you are not sent to the destination. If you typed a password on the page it led to before it was disabled, change that password.
Why was my link refused as a phishing risk?
Its destination is on Google's list of known phishing, malware or unwanted-software sites. If it's your own site and you think that's a mistake, Google Search Console's Security issues report shows what was found and lets you request a review once it's fixed.
See it on your own links
Track Link is free to start: sign in with Google or Microsoft, no credit card.