How to Spot a Malicious Short Link Before You Click

Why do scammers use short links?

A short link masks the real address. Scammers take advantage of this to hide a fake bank, delivery or government site behind a few letters, in a text message or an email. That is the principle of phishing: luring you to a fake page so you enter a password, a code or a card number.

Shortening is not dangerous in itself, and most short links are legitimate. The risk comes from not seeing where you are going. So you need to add a verification step.

Which warning signs should make you stop before clicking?

The link itself says little. The context is what should alert you.

• An unexpected message that rushes you: package on hold, account blocked, fine to pay, prize to claim.
• An unknown sender, or a number or address that does not match the organization it claims to be.
• A request to enter a password, a code received by text or bank details.
• Typos, an unusual tone or an offer that is too good to be true.
• A link sent on a messaging app by an acquaintance whose message does not sound like them: their account may have been hacked.

How do you see where a short link goes without clicking?

There are several ways. On a computer, hovering over a link often shows the full address at the bottom of the browser, but if the link is already shortened, it only shows the short address. A link checker follows the redirect for you and shows the final destination without you visiting it.

Some services offer a built-in preview. With Qlynk, just add the + sign at the end of the link: qlynk.eu/example+ shows the full destination, the site, the date the link was created and the report status, without counting a visit. Make it a habit for any Qlynk link you receive.

What should you check in the destination address?

Once you know the destination, read the domain name, meaning the part right before the first single slash.

• The real domain is the end of the name, before the first /. In irs.gov.account-check.com, the site is account-check.com, not irs.gov.
• Watch for deliberate misspellings (paypa1 with a 1, for example) and names that are too long.
• The padlock or https:// does not prove the site is honest: fake sites have them too.
• If you doubt a bank, an agency or a carrier, do not follow the link: type the known address yourself or open the official app.

How do you report a suspicious short link?

Report it: it protects others. For a Qlynk link, use the report page on qlynk.eu: give the link and the reason (phishing, malware, scam, spam, illegal content or other). The report is reviewed, usually within the day. When several people report the same link, visitors see a warning before the redirect. If the link is dangerous, it is cut off and its author suspended. Qlynk also refuses certain addresses at creation when they are considered dangerous.

For a scam received by message, you can also use the reporting channels of your country. In France, for example, you can forward suspicious texts to 33700, report emails on signal-spam.fr and illegal content on internet-signalement.gouv.fr, and the cybermalveillance.gouv.fr site offers help for victims.

What should you do if you already clicked?

Stay calm and act fast. If you entered nothing, close the page: just clicking is rarely serious. If you entered a password, change it right away on the real site, and everywhere else you use it. If you gave bank details, call your bank to block the card. If you downloaded a file, run an antivirus scan. Keep a screenshot of the message, which helps if you file a complaint.

How do you protect your own visitors when you create links?

If you share short links, it is also up to you to reassure the people who receive them. An unknown link that arrives with no context makes people hesitate, and that is a good thing. Help your readers hesitate less.

Always say what the link opens in the text around it, and sign your messages. Choose a readable link ending, based on your name, instead of a string of letters. Use the same short domain in all your communications so your contacts get used to recognizing it.

You can also tell your audience that they can check a link before opening it. And never use a short link to hide a destination that would not have been accepted in plain sight: on Qlynk, links reported by several people show a warning, and can then be cut off.