How we keep scam links off hi4.in
A short link hides where it goes. That is useful — and scammers know it. Here is exactly what we do to stop hi4.in links being used for fraud, and how you can check any link yourself.
What we check before a link is made
Each warning sign adds to a risk score. Strong signs stop the link from being made at all. Weaker signs are shown as warnings to anyone who previews the link.
Refused straight away
- Look-alike bank, UPI and government websites
Addresses that use names such as SBI, HDFC, ICICI, Paytm, PhonePe, NPCI, IRCTC, Aadhaar, Income Tax or EPFO but are not on that organisation's official website. - Hidden destinations
Addresses with an @ sign trick, where the part you read first is not the website you actually reach.
We also refuse links that point to another hi4.in link, so nobody can hide a chain of redirects behind us.
Flagged as a warning
- Look-alike letters
Website names written with characters from other alphabets (punycode) so they look like a real brand. - Risky website endings
Endings such as .xyz, .top or .zip that are often used by throwaway scam sites. - Bare IP addresses
Links to a number like 203.0.113.7 instead of a website name. - Scam words
Words like KYC, refund, OTP, parcel, electricity or reward in the address — much more serious when combined with a bank or brand name. - Unencrypted pages
Pages on http instead of https, where anything you type can be read on the way. - Disguised addresses
Very long addresses or ones with many sub-parts, used to push the real website name out of view.
Several warnings together can add up to a refusal.
Without an account you can make 5 short links a day, and very fast repeated requests are slowed down. This makes our free tools much less useful for spam campaigns.
A link with no warning signs can still lead to a dishonest website. That is why previews and reports matter, and why you should never share an OTP or UPI PIN because of a link.
These checks run on links made with our website and free tools. We are moving links made through the older dashboard and the API onto the same checks.
Add + to any hi4.in link to see where it goes
Type a + at the end of a hi4.in link and open it. Instead of going to the website, you see a preview page.
- The full address the link opens
- Our safety verdict and the warning signs we found
- A button to report the link if it looks wrong
Password-protected links keep their destination private, so the preview cannot show it. Be extra careful with those.
How link preview worksGot a link from another shortener, or a QR code you are not sure about?
What happens when you report a link
Anyone can report a hi4.in link — you do not need an account, and your email is optional.
You report it
Use the report form or the Report button on a link preview page. Tell us what is wrong in a line or two.
We review it
A person checks the link and where it leads. Our target is to review every report within 24 hours.
We act
If the link breaks our rules we disable it, so it stops working, and we may close the account that made it.
We tell you
If you left your email, we let you know what we did. We do not tell the link's owner who reported it.
If your own link was refused or disabled and you think we made a mistake, contact us and a person will look at it again. Contact us
What gets removed
hi4.in links and pages must not be used for any of these. This is a summary — the full rules are in our acceptable use policy.
Read the acceptable use policy- Phishing pages and fake login, bank, UPI or KYC pages
- Scams: fake jobs, loans, investments, lotteries, refunds and cashback offers
- Malware, and app (APK) downloads from outside official app stores
- Pretending to be a bank, government office, company or person
- Sexual content involving minors, or intimate images shared without consent
- Illegal goods and services, and betting or gambling where it is illegal
- Spam sent to people who did not agree to receive it
- Copyright or trademark infringement, when the owner tells us
What we promise, and what we will publish
No ads, no tracking for advertisers
We never show ads on your links or sell visitor data. Click stats are for the person who made the link.
A real safety report, when we have one
We plan to publish how many links were reported and removed, and how fast we acted. We do not have meaningful numbers yet, and we will not make them up.
Legal requests
We respond to valid requests from Indian authorities under the law, and we share only what the request requires.
How to spot common scams in India
Scam messages change every week, but they follow the same few patterns. If a message makes you panic or promises easy money, stop and check.
KYC update or "account blocked"
Banks do not ask you to update KYC or unblock your account through a link in an SMS or WhatsApp message. Open your bank's own app, or visit the branch.
“Dear customer, your account will be blocked today. Update KYC: …”
Electricity bill cut-off
Messages saying your power will be cut tonight unless you call a number or pay through a link are a common scam. Check your bill in your electricity board's official app or website.
“Your electricity will be disconnected at 9.30 pm. Call our officer …”
Parcel, courier or customs fee
A small "re-delivery" or "customs" fee by link is a classic trick to steal card or UPI details. Track parcels only on the courier's official website or app.
“Your parcel is on hold. Pay ₹25 to update your address: …”
Refund, cashback or prize
You never need to enter your UPI PIN, scan a QR code or share an OTP to receive money. A PIN is only for paying.
“You have won cashback! Scan this QR to receive the amount.”
UPI collect request
A collect request asks you to pay. If someone says "accept this request to receive money", decline it — it will take money from your account.
“I am sending the advance, just approve the request on your UPI app.”
Screen sharing and "support" calls
Real support teams never ask you to install a screen-sharing app or to read out an OTP, PIN or CVV.
“Install this app so our technician can fix your account.”
Read the website name, not the message
Look at the part of the address just before the first single slash. "sbi.co.in" is SBI. "sbi-kyc-update.xyz" is not, however official the page looks.