Why short domains get blocklisted, and how good shorteners prevent it

Here's a risk most people never consider when picking a shortener: it's a shared domain. If one bad actor uses it for phishing or malware and the domain gets flagged by Google Safe Browsing, every customer's links on that domain can stop working at once. Browsers show a red warning, and clicks die. So it matters whether your shortener takes abuse seriously.

Why shorteners are targeted

A URL shortener hides the destination behind a short link, which is what spammers and phishers want: a clean-looking link that leads somewhere nasty. So shorteners are constantly probed. A shortener that does nothing about it is a domain waiting to be blocklisted.

How a responsible shortener defends itself

The good ones layer several defences so bad links never get established:

• Checks at creation: a denylist of known-bad hosts stops a link before it is made, and every new link is queued for a reputation check straight after.
• Safe Browsing lookups: destinations are checked against Google's malware/phishing database.
• Re-scanning: links are re-checked over time, because a destination can turn malicious after approval (the classic bait-and-switch).
• Warn and block pages: a suspicious destination shows an interstitial; a confirmed-bad one is blocked outright, not redirected.
• A report route + review queue: anyone can report a link, and the team acts on it; there's a published security contact.
• No indexing of redirects, so the domain isn't used to launder SEO.

What it means for you

Where you put your links decides whose domain reputation you depend on. A custom domain (Pro and up) puts your links on a domain you own instead of a shared one. Pick a shortener that actively protects it, so a stranger's abuse never breaks your campaign.

What Urlicer actually does

In practice:

• Every link is queued for a reputation check the moment it is created. That covers links made in the app, through the API, in bulk, or anonymously without an account. There is no path that creates a link the scanner never sees.
• The queue drains every thirty seconds against Google Safe Browsing.
• If that check cannot run, the link goes back in the queue rather than being recorded as clean. A quota problem or an outage at our end must never turn into "nobody objected".
• Existing links are re-checked on a rolling sweep, not just at creation. That is what catches the standard evasion: register something harmless, get it shortened, change the page afterwards.
• A blocked link cannot get a QR code from us. A printed code is permanent distribution, and we will not hand that to a destination we have judged harmful.
• Anonymous links cannot take a custom alias or a branded domain. Those are the brand-impersonation tools, and they require an account we can act against.
• We earn nothing from a redirect. No ad interstitials, no monetised redirects, no revenue that would make us slower to block a profitable abuser.
• The abuse contact is published, there is a report form on every warning page, and a flagged destination is named rather than silently followed.

You won't see any of this in the app. It runs in the background while your links keep resolving.

Want links on a domain that's looked after? Start with a free account. Links in your workspace never expire, and every one gets a QR code and click analytics.