#01
nonempty
Destination is not empty
The destination field must contain a full URL like https://example.com — blank submissions are rejected.
Trust & safety
We shorten links. We do not hide scams.
Short links carry trust. A clean short URL should not be a free disguise for a scam. Before any its.gd link is activated, we run the destination through 60 checks — 55 structural and heuristic checks in your browser, then 5 live network and threat-intel lookups on our server. Every check, on every plan, for every visitor.
Here is every single one, in plain language.
55 local checks
Structure & heuristics — in your browser
These run instantly in your browser as you paste a URL. No network required, no data leaves the page.
#02
length
URL length within sane limit
Extremely long URLs are a common trick to hide the real destination behind pages of characters.
#03
whitespace
No embedded whitespace
Real links never contain spaces or tabs inside them. Whitespace usually means the URL was pasted broken or was crafted to bypass filters.
#04
control
No control characters
Invisible control characters can disguise the true destination from the human eye while browsers still follow them.
#05
parse
Parses as a valid URL
The URL must be parseable by the same WHATWG URL rules browsers use — malformed input is refused.
#06
scheme
Protocol is http or https
Only http:// and https:// links are shortened. Schemes like ftp:, file:, javascript: or data: are blocked at the door.
#07
https
Prefers HTTPS
Plain http:// destinations trigger a warning — visitors' browsers may mark them as not secure.
#08
userinfo
No embedded credentials
URLs like https://paypal.com@attacker.tld put credentials before the real host to make a phishing link look legitimate.
#09
host
Hostname present
The URL must have a hostname — there has to be an actual domain to send visitors to.
#10
host_dot
Hostname is fully qualified
Bare names like "server" (with no .com/.org/…) are internal-only and never valid public destinations.
#11
private
Not a private or local address
localhost, 127.0.0.1, 10.x.x.x, 192.168.x.x and other RFC1918 ranges are internal networks and cannot be public destinations.
#12
ip_literal
Rejects raw IP addresses
Legitimate public sites use domain names, not bare IPs. Raw IPs are a strong indicator of throwaway or malicious infrastructure.
#13
at_symbol
No @ in the authority
An @ sign in the wrong position hides the real host from casual readers — a classic phishing disguise.
#14
subdomain_depth
Reasonable subdomain depth
Chains like paypal.com.login.verify.attacker.tld try to look like a trusted brand while actually pointing somewhere else.
#15
label_length
DNS label lengths valid
Each label of the hostname must respect the 63-character DNS limit. Oversized labels are malformed.
#16
label_hyphens
No malformed hyphens
Leading, trailing, or consecutive hyphens in a hostname are invalid under DNS rules and often indicate look-alike domains.
#17
punycode
Homograph / punycode scan
Punycode (xn--…) hostnames can render as familiar brands using Cyrillic or Greek look-alikes. We surface every punycode host.
#18
ascii_host
Hostname script check
Non-ASCII hostnames can be legitimate international domains — or a homograph attack. We flag them for review.
#19
tld_present
Top-level domain present
Every real hostname ends in a TLD like .com or .org. Missing TLD = malformed URL.
#20
tld_risky
TLD reputation lookup
Some TLDs (.tk, .top, .cf, .ml, …) are dominated by abuse in public threat-intel data. We warn on those.
#21
tld_confusable
TLD not filename-confusable
TLDs like .zip and .mov look like file extensions, tricking users into believing a link is a file download.
#22
sld_length
Registrable domain length
The registrable domain (the part you'd buy) being extremely short or long is a signal of disposable infrastructure.
#23
digit_ratio
Digit ratio in domain
Domains that are mostly digits are typical of algorithmically generated throwaway hostnames used by malware.
#24
hyphen_count
Hyphen count in domain
Domains with many hyphens (e.g. secure-login-paypal-verify.com) are a phishing look-alike hallmark.
#25
entropy
Random-domain entropy check
High character entropy (looks like keyboard mashing) is typical of disposable malware C2 domains.
#26
shortener_chain
Shortener-chain guard
We refuse to shorten another shortener. Chained shorteners hide the true destination and defeat safety scanning.
#27
brand_subdomain
Brand impersonation (subdomain)
Patterns like paypal.attacker.com use a trusted brand as a subdomain of an attacker-owned host.
#28
brand_path
Brand impersonation (path)
Patterns like attacker.com/paypal-login put a brand name in the path to bait clicks.
#29
block_words
Hostile keyword scan
Keywords repeatedly linked to malware distribution or scams anywhere in the URL trigger a warning.
#30
scam_host
Scam keywords in host
Hostnames like free-gift-verify-now.tld are almost always scams. We flag the pattern.
#31
scam_path
Scam keywords in path
Scam wording in the URL path ("claim-reward", "account-suspended") is a lower-confidence signal but worth surfacing.
#32
dangerous_ext
Dangerous file extension
Direct links to .exe, .scr, .bat, .apk, .msi, .hta and similar executables are blocked outright.
#33
double_ext
Double-extension trickery
Filenames like invoice.pdf.exe are the classic malware disguise — the real extension is the last one.
#34
host_encoded
Hostname not percent-encoded
Encoding characters in the hostname (%65%78 …) is nearly always an attempt to hide the true destination from readers.
#35
path_length
Path length is reasonable
Unusually long paths can bury the real target parameter deep enough that visitors never notice it.
#36
open_redirect
Open-redirect parameter
Query parameters like ?url=…, ?next=…, ?redirect=… pointing at another host are laundered through the trusted domain to bypass filters.
#37
data_uri
Not a data: URI
data: URIs can embed arbitrary HTML or scripts directly in the link — never a safe destination for a shortener.
#38
js_uri
Not a javascript: URI
javascript: URIs run attacker-supplied code in the visitor's browser. Always blocked.
#39
fragment_js
No script in URL fragment
The part after # can be interpreted by some single-page apps — we reject script-like fragments.
#40
port
Standard web port
Legitimate public sites almost always serve on ports 80 or 443. Non-standard ports are a strong outlier signal.
#41
host_abuse_terms
Host has no threat terms
Hostname contains words repeatedly associated with phishing infrastructure in public threat feeds.
#42
double_dot
No consecutive dots in host
Consecutive dots (example..com) are invalid under DNS rules and often used to slip past naive parsers.
#43
edge_dot
No leading/trailing dot
A hostname starting or ending with a dot is malformed and often crafted to confuse filters.
#44
query_bloat
Query string size reasonable
Massive query strings are sometimes used to smuggle encoded payloads through the URL.
#45
blob_query
No opaque blob in query
Long base64/hex blobs in the query string can hide the real destination or exfiltration payload from casual inspection.
#46
self_ref
Not an its.gd → its.gd loop
Destinations pointing back to its.gd would create a redirect loop and are refused.
#47
tld_alpha
TLD is alphabetical
TLDs must be alphabetical — numeric or mixed TLDs are invalid.
#48
brand_plus_security
Brand + security-word pattern
Combinations like paypal-login-verify.tld or apple-secure-signin.tld are the phishing playbook. We warn every time.
#49
hash_length
Fragment length reasonable
Very long URL fragments are unusual and sometimes carry encoded payloads.
#50
homoglyph_brand
Digit-for-letter brand spoof
Look-alikes like g00gle.com, paypa1.com, micros0ft.com swap digits for letters to spoof known brands.
#51
mixed_script
No mixed Latin / Cyrillic
Mixing Latin and Cyrillic characters (аpple.com with a Cyrillic а) is a classic homograph attack.
#52
emoji_host
No emoji in hostname
Emoji hostnames are almost always novelty or spoof domains, not legitimate businesses.
#53
self_host
Not our own domain
Refuses destinations that are its.gd itself, preventing loops and abuse of our own domain reputation.
#54
reserved_tld
TLD not reserved
.test, .example, .invalid, .localhost are reserved for testing per RFC 2606 and never valid public destinations.
#55
reported_abuse
Prior abuse-report lookup
Cross-checks the destination against links previously reported as abusive by its.gd users.
Every visitor always sees an interstitial
No its.gd link ever redirects silently — and we never redirect automatically, not even on green. Every single click lands on a transparent interstitial that names the real destination and shows a traffic-light result: green — no threats found; orange — something looks off, with an explanation of why; red — serious risk, with a strong warning. In every case the visitor decides and clicks to continue. That page carries no ads and no third-party trackers.
Malicious links are refused at creation
If the scan flags a destination as malicious — malware, phishing or fraud — we refuse it. The short link is never created, so it can never be shared, and the refusal happens on our servers, not just in the browser. The person shortening the link gets a clear explanation and can ask us to review the decision.
Suspicious links are allowed, but always explained
Suspicious destinations can still be shortened — false positives happen, and we don't want to be a gatekeeper for anything that merely looks unusual. Instead, every visitor sees the orange interstitial that names the destination domain and lists, in plain language, the exact findings of the check we run at that moment. The visitor decides.
Links can be taken down after activation
If a report or our own review shows a destination is abusive, we deactivate the short link. It stops resolving — visitors get a “link not found” page instead of being sent on to the destination.
A link can never be moved to another website
Once a link is activated, it is bound to one website for life. This prevents a common bait-and-switch scam: someone creates a short link to a trusted site, shares it widely to build clicks and reputation, then swaps the destination to a scam page. The same short URL would silently mean something new, and visitors would follow based on trust earned by the old destination. On its.gd that swap is impossible — not discouraged, impossible.
Free links are locked for good — there is no correction path at all. On paid plans, the one thing an owner can do is correct a mistake on the same website: a typo, or a page that moved. Those corrections are boxed in on every side — same registrable domain only, a full re-scan that must come back green with zero warnings, a hard limit of two per billing period, and a permanent public record. The safety page for the link shows that the destination was corrected and when, so nothing happens quietly.
To point a short link at a different site, you delete it and create a new one. The old short URL stops working, so anyone holding the previous link gets a dead link instead of an unexpected redirect, and the new link starts with no clicks, no reputation, and no inherited trust.
Free links are locked for good — there is no correction path at all. On paid plans, the one thing an owner can do is correct a mistake on the same website: a typo, or a page that moved. Those corrections are boxed in on every side — same registrable domain only, a full re-scan that must come back green with zero warnings, a hard limit of two per billing period, and a permanent public record. The safety page for the link shows that the destination was corrected and when, so nothing happens quietly.
To point a short link at a different site, you delete it and create a new one. The old short URL stops working, so anyone holding the previous link gets a dead link instead of an unexpected redirect, and the new link starts with no clicks, no reputation, and no inherited trust.
Anyone can report an unsafe link
Append + to any its.gd link (e.g. its.gd/sale+) to preview the destination, see its current safety result, and report abuse.
What we don't claim
We never say a link is “100% safe.” No scanner can guarantee that. We say what we can stand behind: no known threats found, checked before activation, malicious destinations refused, and monitored for abuse.
Report a link
Saw something off? Tell us and we'll review.