How hrva.cc stops phishing links

In September 2026, a new account used hrva.cc to share links to fake Njuškalo and Jófogás pages. Google Safe Browsing didn't catch them, and neither did anything else we checked them against later. This post explains why, and the layers hrva.cc now uses to stop links like these.

What happened

Njuškalo and Jófogás are popular classifieds sites in Croatia and Hungary. In mid-September, one new account created a batch of hrva.cc links to pages that copied them, on domains such as njuskaio[.]cam and jofogas[.]cards. The domains had been registered the same day the links appeared. The links stayed up for weeks before we found them.

When we checked those domains in October, none of the outside services had flagged them. Google Safe Browsing let them through. So did HaGeZi's threat lists, which hold more than two million known bad domains, and the malware-blocking DNS from Quad9 and Cloudflare.

That isn't a failure of those services. A list can only block a site after someone has spotted it, and a domain registered that same day has no history yet. The lesson for us was that lists alone are too slow for scams on fresh domains. So hrva.cc now also looks at how old a domain is, and at whether its name imitates a well-known brand.

Checks when a link is created

No single check catches everything, so hrva.cc runs several. Each one covers gaps in the others.

• Google Safe Browsing. Every destination is checked against Google's database of phishing and malware sites when the link is created, and again every night. We wrote about this in Why Safe Browsing matters for link sharing and Safe Browsing at scale.
• Local blocklists. hrva.cc downloads public blocklists to its own server and refreshes them several times a day. Some list harmful domains. Others list exact links, which lets us catch one bad page on a trusted host without blocking the whole host. Because the lists live on our server, checking a link against them sends it nowhere.
• Domain age. hrva.cc asks the domain's registry when the domain was registered. A brand-new domain gets a closer look.
• Lookalike and lure signals. A name that imitates a well-known brand, or an address dressed up as a login or verification page, is a warning sign. Signals like these add up. A single weak one never blocks a link on its own; it sends the link to a person instead.
• Spamhaus. Destination domains are also checked against the Spamhaus domain blocklist, which tracks domains used for phishing, malware and spam.
• Redirect checks. A link can point to a harmless-looking address that then redirects to a scam. After a link is created, hrva.cc follows its redirects in the background and checks every address along the way.

Checks after a link is live

• Every night. All active links are checked again against Safe Browsing and the latest lists, so a site that turns bad later still gets caught.
• Every click. Before a visitor is sent anywhere, the destination is checked against the blocklists that block outright. If it has been listed since the last check, the link stops working on that click, and the visitor sees a page saying the link isn't available.
• Domain rules. When a domain is clearly bad, we can block it, and every link to it stops working at once. We can also mark a domain as trusted, to undo a false alarm.

A person makes the hard calls

Some links look doubtful but are fine. A small business on a new domain, or a real login page, can trip the same signals as a scam. Blocking those automatically would hurt real people, so doubtful links aren't blocked. They go to a review queue, and a person decides: the link is fine, the domain is trusted, or the link, the domain or the account gets blocked.

Accounts that act like typical scam accounts are marked as possible scammers in that queue, so they're easy to spot. The marker never blocks anything by itself. Blocking an account is never automatic. A daily email lists the decisions waiting, so nothing sits in the queue unseen.

Limits and reports

• Rate limits. Visitors and accounts can only create so many links in a short time, so one account can't flood hrva.cc with scam links.
• Reports from visitors. Anyone can report a link on the report page. Reports go to the review queue. They never block a link on their own, so nobody can take down someone else's link just by reporting it.

What it can't catch

These checks make hrva.cc much harder to abuse, but they aren't perfect. They can miss:

• Bad files on trusted hosts. A harmful file on a big file-sharing or cloud service is only caught once it's on a list of exact links. We won't block a whole trusted host for one bad file.
• Scams on old or hacked domains. A domain with a long, clean history looks normal until a list picks it up.
• Pages that change by visitor. Some scam pages show a harmless page to checkers and the scam to real visitors.
• JavaScript redirects. hrva.cc follows normal web redirects, but not ones a script inside the page performs.

What you can do

• Be wary of short links in messages. Scam links often arrive in chats, texts and emails. If a message pushes you to log in, pay or confirm your details through a link, don't. Open the site yourself by typing its address.
• Check before you click. Check a link shows where a hrva.cc link goes without opening it.
• Report it. If a hrva.cc link leads somewhere harmful, report it at /report or email abuse@hrva.cc with the short link.

Thanks

This protection stands on the work of people who track threats and share what they find: HaGeZi, URLhaus by abuse.ch, OpenPhish, PhishTank, the Phishing.Database project and Spamhaus. Thank you.