日本語で読む場合はこちら。

Six ways to spot a phishing short URL

Published 23 September 2026 · PAPS editorial team

Short URLs like qr.paps.jp/xxxxx pack a long URL into a handful of characters — convenient, but the same property (the actual destination domain is hidden) makes them the delivery method of choice for phishing scams. If you have ever hesitated over an unfamiliar short URL in a text message or DM, you already know the feeling.

This article covers six checkpoints for judging whether a short URL is safe before you click it, how qr.paps.jp auto-detects malicious links, and what to do if you have already been caught.

Who this is for:
Anyone who has received an unexpected short URL over SMS, DM or email and had to decide whether to open it. Event organisers who post QR codes in public will also find the "physical QR" section useful.

Why short URLs and phishing go together

A normal URL like https://www.example-bank.co.jp/login at least tells you which domain your browser is about to talk to. Short URLs replace that with a few opaque characters — you cannot see the final destination until you have already committed to opening it.

That opacity is what scammers exploit. Fake bank logins, fake parcel-tracking pages and fake authentication prompts are all commonly delivered through short URLs. According to security-industry telemetry, well over a third of phishing URLs in circulation pass through some form of URL-shortening or redirect service.

Six checkpoints for spotting a suspicious short URL

TL;DR: If you cannot verify the sender is who they claim to be, do not click. Preview the expansion, read the tail of the domain, and never override a browser safety warning. Everything below is a variation of those three habits.

1. Doubt the sender's identity first

SMS or DM claiming to be from your bank, your phone carrier, a delivery service or a tax office? Before touching the link, confirm the sender's number or account handle against the organisation's official website. One-character look-alikes and emoji-decorated spoofs are extremely common.

2. Beware of time pressure

"Your account will be frozen unless you act within 24 hours." "Confirm your identity today or your delivery will be returned." Any message designed to rush your decision is a classic scam pattern. Real banks and shipping companies rarely demand instant action via a single SMS. Take a breath and log into the service directly through its official app instead of following the link.

3. Preview the short URL before opening it

Several free tools let you paste a short URL and see the final destination without visiting it. On a phone, long-press the link and choose "copy link" — then read the copied text out loud to yourself. On a desktop, hover over the link and check the status bar preview at the bottom of the browser window.

If the preview goes through several redirect hops, that itself is a warning sign — legitimate services rarely need more than one or two redirect steps.

4. Read the domain from the right

If the expanded destination ends in .tk .cf .ml .ga .gq — free throw-away TLDs — treat it as hostile. Also watch out for real brand names hidden as sub-domains: mufg.security-check.example.top looks like MUFG bank but is actually on example.top. Always read the two labels immediately to the left of the last dot; that is the domain someone paid for. Everything else is under their control.

5. QR codes are just short URLs with extra steps

"Quishing" — sticking a fake QR code over a legitimate one in restaurants, EV chargers, parking meters or event venues — has been climbing since 2024. When your phone shows a preview after scanning, apply exactly the same domain-tail check as with any other short URL. If the scanner opens the browser without a preview, close the tab immediately and repeat the scan with an app that does show the URL first.

6. Never override a browser warning

If Chrome, Safari, Edge or Firefox displays a red "Deceptive site ahead" or "This site may be dangerous" screen, that means Google Safe Browsing or Microsoft SmartScreen has already classified it as malicious. Buttons like "Continue anyway" or "Show original" exist for developers debugging their own sites — they are not an argument to keep clicking.

How qr.paps.jp auto-detects phishing

qr.paps.jp is built with the assumption that some fraction of the URLs users try to shorten will be malicious. To catch those before they can hurt anyone, the service runs a two-stage safety check on every short URL after creation:

Stage 1: Google Safe Browsing v4

Every newly created short URL is matched against Google's global phishing / malware block list via the Safe Browsing v4 API. A hit disables the short URL — visitors are redirected to the qr.paps.jp home page instead of the malicious destination.

Stage 2: OpenPhish community feed

Because Safe Browsing lags for brand-new phishing kits (especially on non-US TLDs), qr.paps.jp also polls the OpenPhish community feed every 10 minutes and applies a secondary check. A URL that Safe Browsing missed but OpenPhish already knows about is still blocked.

In addition, adult and sensitive domains trigger an interstitial confirmation screen before the redirect executes, so a visitor is never sent to an unexpected sexually-explicit or otherwise sensitive destination without warning.

What to do if you have already clicked

If you have entered a password, banking details or a credit card number after clicking a short URL you now suspect was a phishing link, act in this order:

Contact the affected service immediately and ask them to freeze the account or card.
Report the incident to your local anti-fraud authority. In Japan, dial #9110 for police guidance or contact the nearest prefectural cybercrime unit. In the US, file a report at reportfraud.ftc.gov. In the UK, forward suspicious messages to 7726 and report the site to report.ncsc.gov.uk.
Change the affected password from a different, trusted device, and enable two-factor authentication if it was not already on.

Using qr.paps.jp safely (as a sender)

When you are the one distributing a short URL — event announcements, printed leaflets, social posts — the following habits reduce the chance that recipients hesitate to click:

Choose a shortener whose domain is trusted. qr.paps.jp runs the phishing detection described above; well-known shorteners like bit.ly or a platform's own t.co are equally reasonable defaults.
Always frame the short URL with context — "Details for our 10 March event: qr.paps.jp/xxxxx" rather than the bare URL alone. Recipients decide based on context as much as on the URL itself.
Report abuse when you see it. qr.paps.jp accepts abuse reports at the abuse report form; the operations team disables confirmed malicious short URLs.

Summary

Short URLs are dangerous precisely because they hide information the reader needs. Preview the expansion, read the tail of the domain, and trust your browser's warnings. Those three habits alone will neutralise most phishing attempts you encounter.

Choosing a shortener with built-in phishing detection — like qr.paps.jp — takes care of the cases where the sender is genuine but the destination was compromised. Between sender diligence and platform automation, the day-to-day short-URL landscape can be a lot safer than it currently is.

← Back to help index