The URL shortener that makes your links look as suspicious as possible
332 points
5 hours ago
| 27 comments
| creepylink.com
| HN
boerseth
1 minute ago
[-]
I always think back to some of the emails I used to receive at my old jobs, inviting the whole company to take a survey or join a streamed all-hands meeting or whatever. The links in those invites were so cursed, using some cryptic third party service, with the name of the company shoved in somewhere inconvenient, and a truckload of parameters. They all felt like straight out of the phishing-detection classes that they also forced the whole company to complete twice a year. Sometimes it felt like a test.
reply
postalcoder
4 hours ago
[-]
There may actually be some utility here. LLM agents refuse to traverse the links. Tested with gemini-3-pro, gpt-5.2, and opus 4.5.

edit: gpt-oss 20B & 120B both eagerly visit it.

reply
devsda
2 hours ago
[-]
I wish this came a day earlier.

There is a current "show your personal site" post on top of HN [1] with 1500+ comments. I wonder how many of those sites are or will be hammered by AI bots in the next few days to steal/scrape content.

If this can be used as a temporary guard against AI bots, that would have been a good opportunity to test it out.

1. https://news.ycombinator.com/item?id=46618714

reply
xlii
1 hour ago
[-]
I posted my site on the thread.

My site is hosted on Cloudflare and I trust its protection way more than flavor of the month method. This probably won't be patched anytime soon but I'd rather have some people click my link and not just avoid it along with AI because it looks fishy :)

reply
treebeard901
1 hour ago
[-]
I've been considering how feasible it would be to build a modern form of the denial of service low orbit ion cannon by having various LLMs hammer sites until they break. I'm sure anything important already has Cloudflare style DDOS mitigation so maybe it's not as effective. Still, I think it's only a matter of time before someone figures it out.

There have been several amplification attacks using various protocols for DDOS too...

reply
testfrequency
1 hour ago
[-]
Glad I’m not the only one who felt icky seeing that post.

I agree my tinfoil hat signal told me this was the perfect way to ask people for bespoke, hand crafted content - which of course AI will love to slurp up to keep feeding the bear.

reply
jnrk
2 hours ago
[-]
Of course, the downside is that people might not even see your site at all because they’re afraid to click on that suspicious link.
reply
postalcoder
1 hour ago
[-]
Site should add a reverse lookup. Provide the poison and antidote.
reply
PUSH_AX
44 minutes ago
[-]
LLM led scraping might not as it requires an LLM to make a choice to kick it off, but crawling for the purpose of training data is unlikely to be affected.
reply
Barathkanna
2 hours ago
[-]
Sounds like a useful signal for people building custom agents or models. Being able to control whether automated systems follow a link via metadata is an interesting lever, especially given how inconsistent current model heuristics are.
reply
qnleigh
51 minutes ago
[-]
What's up with the creepy ads on this website? It seems like they are actually sketchy ads and not just fake ads for comedic effect. One shows some scammy nonsense about your device being infected and the other links to a real VPN app.
reply
arjvik
4 hours ago
[-]
My favorite link of all time:

https://jpmorgan.c1ic.link/logger_zcGFC2_bank_xss.docm

Definitely not meta

reply
fuddle
3 hours ago
[-]
Imagine using this as your personal website lol
reply
morshu9001
1 hour ago
[-]
email too
reply
gnabgib
5 hours ago
[-]
Related: A URL shortener not shortening the URL but makes it look very dodgy (434 points, 2023, 100 comments) https://news.ycombinator.com/item?id=34609461
reply
phoe-krk
11 minutes ago
[-]
I wouldn't call it a shortener, since most of the links it creates are longer than the originals.

What would be a good name here? A URL redirector?

reply
johnisgood
5 minutes ago
[-]
URL lengthener. :D
reply
phoe-krk
3 minutes ago
[-]
reply
bityard
4 hours ago
[-]
IIRC, shadyurl was the original version of this. Doesn't seem to be around anymore, though.
reply
nomel
3 hours ago
[-]
shadyurl a whole bunch of different incredibly shady domains that were used at random. it was beautiful.
reply
champagnepapi
5 hours ago
[-]
reply
reincarnate0x14
3 hours ago
[-]
https://jpmorgan.web-safe.link/flash_7KzCZd_money_request

I love this version and I hope you do too.

reply
html5cat
4 hours ago
[-]
well played sir
reply
juliangmp
15 minutes ago
[-]
This is legit! If you disable your adblock you even get a suspicious ad
reply
jmward01
3 hours ago
[-]
reply
bl4ckneon
1 hour ago
[-]
Thought this might be it... I clicked it anyways haha. I will need to update the Rick roll url on my nfc implant with this new link!
reply
caminanteblanco
4 hours ago
[-]
I'm not sure what the use case for this is, but I've been using it as a inefficient messaging service with my girlfriend, ie:

https://c1ic.link/campaign_WxjLdF_login_page_2.bat

You seem to be able to encode arbitrary text, so long as it follows [A-Za-z0-9]+\.[A-Za-z0-9]+

reply
rendall
7 minutes ago
[-]
This is the best article on Wikipedia!

https://c1ic.link/bzSBpN_login_page_2

Edit: Chrome on Android warned me not to visit the site!

reply
dreadsword
5 hours ago
[-]
Saw this on relaunched Digg and figured HN would appreciate it.
reply
qweiopqweiop
15 minutes ago
[-]
Now that's a name I've not heard in a long time
reply
koakuma-chan
5 hours ago
[-]
I don't appreciate how AI generated this website looks.
reply
nimih
3 hours ago
[-]
It seems appropriate that, for a website whose purpose is to make links which raise your suspicions, the visual design itself also raises your suspicions.
reply
olyjohn
3 hours ago
[-]
Just looks like every other generic framework oriented site.
reply
4k93n2
4 hours ago
[-]
which bit are you getting an AI smell from?
reply
koakuma-chan
4 hours ago
[-]
gradient background, card, button
reply
Alupis
4 hours ago
[-]
Perhaps, but nearly every tutorial in all the modern frameworks demonstrate this exact style.
reply
bundie
3 hours ago
[-]
Digg is back?

Edit: looks like you need an invite code.

Bummer

reply
jhalderm
2 hours ago
[-]
Fantastic! I miss the original ShadyURL.

https://news.ycombinator.com/item?id=31386108

reply
lzap
2 hours ago
[-]
I like how old-school HN comment section does not care about creepy links at all. Or link for that matter.
reply
dieggsy
2 hours ago
[-]
This is fun. Is it not checking for previously submitted URLs though? I can seemingly re-submit the exact same URL and get a new link every time. I would expect this to fill the database unnecessarily but I have no idea how the backend works.
reply
saghm
1 hour ago
[-]
Am I missing something, or would these essentially be implemented via DNS records? It's not clear to me that keeping the links in a database would be necessary at all (unless the DNS records are what you mean by "database")
reply
janwillemb
1 hour ago
[-]
DNS is only for resolving the host part. The path is not passing through a dns query.

In example.com/blah, the /blah part is interpreted by the host itself.

And apart from that I would indeed consider DNS records a database.

reply
domoregood
5 hours ago
[-]
reply
archb
2 hours ago
[-]
reply
hahahahhaah
4 hours ago
[-]
reply
zakki
2 hours ago
[-]
reply
lzzzam
35 minutes ago
[-]
I can just say thanks
reply
FuturisticLover
2 hours ago
[-]
I am sharing content using these creepy links to send to office people.
reply
fancychancy
5 hours ago
[-]
Haha, it's fun. Just thinking, is there some place where creepy links would be better ?
reply
AnotherGoodName
4 hours ago
[-]
I've been at a company that internally sends out fake links that log the user and links to an educational page on internet safety.

I honestly don't mind too much since it's a once a year thing (hacktober) and honestly companies should be trying to catch out employees who click any and all links.

reply
trollbridge
3 hours ago
[-]
We used to have fun hammering millions of requests to such URLs from a VPS when they would send such emails to role mailboxes.

Eventually we got asked to please make it stop. I asked them to please stop sending fake phishing emails to robots.

reply
abhinai
2 hours ago
[-]
Please take my upvote. :)
reply
CGMthrowaway
4 hours ago
[-]
Use case? Besides humor and phishing tests
reply
cr125rider
4 hours ago
[-]
Fun!
reply
awesome_dude
5 hours ago
[-]
reply
vanc_cefepime
5 hours ago
[-]
I added google.com and it spit out https://twitterDOTc1icDOTlink/install_Jy7NpK_private_videoDOTzip

Interesting that it spit out a .zip url. Was not expecting that so I changed all the “.” to “DOT” so I don’t get punished for posting a spammy link despite this literally being a website to make links as spammy and creepy as possible.

reply
fuddle
3 hours ago
[-]
lol, I'm not clicking a .vbs link
reply
CrimsonCape
5 hours ago
[-]
It is hilarious and i'm not clicking any link lol.
reply
pabs3
4 hours ago
[-]
Please don't make any more URL shorteners, they are just a bad idea.

https://wiki.archiveteam.org/index.php/URLTeam

reply
aussieguy1234
4 hours ago
[-]
I always end up making my own, they're so simple to write.

Saves using one of the "free" ones which looks like its free but you're actually on a free trial, then you can't access your links after that trial expires.

reply