A short link hides where it leads, which makes it useful to people who want to trick others. This page explains how we keep phishing, malware and scam links off SendURL, and what you can do if you find one or think we made a mistake.
When we check a link
Every short link is checked when it is created, and again whenever its destination is edited. The check covers every place the link can send someone:
- The link's destination.
- Its app destinations for iPhone and Android, if it has them.
- Every destination in an A/B test, and the destination you choose when you pick a test's winner.
What we check for
We check each destination against industry threat-intelligence services and against our own rules. We look for phishing, malware, unwanted or harmful software, and scams.
Our own rules also refuse a link that:
- Hides its real address behind a user name or password. For example,
https://yourbank.com@another-site.examplelooks like it leads to yourbank.com, but it opens another-site.example. - Directly downloads a program or an installer.
- Holds more than fifteen web addresses in total, counting its destinations and the web addresses inside them. We check every one of them, so we limit how many a link can carry, and how many one destination can lead to.
If a link is refused or taken down
A link our own rules catch is refused at once. Nothing is created: no short link exists for that destination. If you were editing a link, nothing is changed and the link keeps its previous destination. You see a message explaining why.
A link the threat-intelligence services find dangerous is taken down, usually within seconds of being created or changed, and at the latest the next time we check all links. It stops redirecting, and anyone who opens it sees a page saying the link was taken down. In your account it is marked as moderated and switched off.
If you use the SendURL API, a refused request fails with a 422 error and the code unsafe_destination, or too_many_urls for a link with too many web addresses. A link taken down after it was created or changed has moderated set to true and active set to false. Both are described in our API documentation.
Links that already exist
We check links that already exist too. A link we find to be dangerous is taken down: it stops redirecting and shows a page saying the link was taken down.
Links created without an account
You can shorten a link on our website without an account. These links are checked in the same way.
Report a dangerous link
Anyone can report a short link that leads to phishing, malware or a scam, with or without a SendURL account, on our Report a link page. You can also write to safety@sendurl.to directly. Every report is read by a person.
Where a report is urgent and clearly made out, such as phishing, we disable the link first and look into it afterwards.
If you think we got it wrong
If a safe link was refused, or one of your links was taken down and you believe it is safe, write to us through our grievance page or our contact page, or email safety@sendurl.to. Include the short link or the destination, and why you believe it is safe.
A link we took down can't be switched back on from your account. We will look at it again and reply, and if it is safe, we will restore it.
No check catches everything
No automated check catches every dangerous link: new phishing and malware sites appear all the time, and some are not yet known to anyone. If you come across a SendURL link that looks dangerous, please report it. Reports help us catch what the checks miss.