Destinations are checked against known phishing and malware domains when a link is created. Anyone can add + to a zou.sh link to see where it goes first.
Anyone can report a link. No account needed.
How it works
Each destination is compared with a blocklist of about 390,000 phishing and malware domains, refreshed every night from two open sources.
Add + to a zou.sh link, as in zou.sh/careers+, to see the destination, creation date and clicks without visiting it.
Anyone can report a link from its preview page. Abusive links are disabled and show a “This link was disabled” page.
Why it helps
About 390,000 phishing and malware domains from URLhaus (abuse.ch) and the Phishing.Database project, refreshed every night.
URLs with a user name or password before the host, like user:pass@, are refused. That trick is a classic way to disguise a destination.
Destinations on a private network or a local machine are refused. A public short link should only lead to the public web.
A zou.sh link can’t point to another zou.sh link. Chains add hops and hide the real destination.
Every zou.sh link has a public + page with its destination, creation date and total clicks, so anyone can look before visiting.
Each preview page has a “Report this link” form, and there is an abuse form too. Abusive links are disabled and answer with HTTP 410.
The blocklist
The blocklist catches domains already known for phishing or malware. No list is complete, and a site registered this morning may not be on one yet. That is why previews and reports matter too.
Any shortener
The free link expander shows where any short link leads, including bit.ly, tinyurl.com and t.co links. Developers get the same answer from the API, with every hop of the redirect chain and a safety verdict.
Open the link expanderAvailability
Everything in the first column works right now, with no account. The second comes with accounts, now in early access.
Live Today, free, no account
Early access With an account
FAQ
No check can promise that a link is safe. Add + to a zou.sh link, or paste any short link into the link expander, then read the destination’s domain carefully before you visit.
Two open sources: URLhaus, run by abuse.ch, and the Phishing.Database project. Together they list about 390,000 phishing and malware domains, and our copy is refreshed every night.
Its domain matches the phishing and malware blocklist, so it was refused with the error unsafe_destination. Why was my link refused? explains what to do if you think it’s a mistake.
Reports are reviewed, and abusive links are disabled. Visitors then see a “This link was disabled” page, served with HTTP 410. A report stores only the link code, your optional reason and the date.
Yes. Paste it into the link expander to see where it leads without opening it. We can only disable zou.sh links, so report others to the service that created them.
No. Visitors go straight to the destination. Known bad domains are refused when a link is created instead, and reported links are disabled.
Guide
How to check where a short link goes, and whether it is safeCheck where a short link goes before you click: the + preview on zou.sh, tricks for other shorteners, a free link expander, phishing red flags and what to do next.
Help
How do I see where a zou.sh link goes?Add + to the end of any zou.sh link to see its destination, creation date and total clicks before you visit. The link expander and the API work too.
Help
Why was my link refused?Every refusal comes with an error code, from invalid_url to rate_limited. Here is what each code means and what to do about it.
Solutions
Blinkhop for privacyWorks over Tor and VPNs. No captchas, no tracking.
Add + to any zou.sh link, or paste any short link into the free link expander.
