How Lox screens links
Short links can hide where they lead, which makes them useful to scammers. Lox checks every new link before it redirects, and keeps checking recent links after that.
When a link is created.
-
Known threats
The destination is checked against Google Safe Browsing and five public blocklists: Spamhaus, URLhaus, PhishTank, OpenPhish and the Phishing Database. Lox refreshes the lists every day.
-
Redirects
If the destination redirects, Lox follows the chain and checks each address on the way.
-
The domain
Punycode hosts, which can imitate familiar names, raise a link's risk score. So do domain endings that are often abused, such as .zip, .mov, .xyz and .top.
-
The decision
A link with a high score is held and won't redirect until it has been reviewed.
After a link goes live.
Links created in the last 30 days are checked again every hour, because a site that was clean on Monday can be compromised by Friday. If Google Safe Browsing can't be reached when a link is created, the link goes live and is checked again on the next pass.
If your link is held.
Visitors see a notice instead of your destination, and the link shows as pending in your dashboard. If you think it's a mistake, ask for a review and include the short link.
Report a harmful link.
If a Lox link leads somewhere harmful, report it with the short link and what you saw. Reported links are reviewed and blocked if they break the terms. Accounts that keep breaking them are suspended.
What screening can miss.
A brand-new phishing site may not be on any list yet. Screening lowers the odds and reports close the gap. To check any link yourself, use the free link checker, which runs the same tests.