Nearly four years in: 180,000 short links, 10 million visits, 30,000 people who have shortened links, and 300,000 blocked attempts to reach malicious sites. Not a cent spent on SEO services or advertising. Sounds pretty good, except my total earnings are a whopping ~~$20~~ $19.56. Here’s how it started, what went wrong, and why I’m still happy to keep working on my URL shortener, Clipr.cc.
## How I got myself into this
I build online stores. One day, a client complained that their links didn’t work in a messaging app. After a lot of digging, I found the culprit: the desktop app was cutting them off. A URL shortener should fix that, right? Except the services I tried from Google’s top 20 results wouldn’t accept the domain in Punycode, the encoding used for non-Latin domain names. So I spent a couple of hours building the client a shortener. Problem solved.
A few years later, I needed to brush up on my coding skills for a new client project. I didn’t want to use their project as a training ground, so I decided to build something of my own. I remembered the shortener: a familiar problem, a small project, perfect for practice. What could possibly go wrong?
Here’s what I ended up with first version: https://web.archive.org/web/20240614164816/https://www.clipr.cc/
## Maybe it could cover the hosting bill
The shortener worked. It shortened links and redirected people. Punycode and all sorts of valid URL characters worked just fine. After a while in Google’s index, the first users and links started appearing.
I looked at the competition and ruled out building another Bitly. My budget for growing the project was $0. Hosting and the domain were my only expenses.
My plan was simple: free, minimal, no dashboards, a little advertising on the main pages. No popunders turning the site into Las Vegas after dark. No ads between clicking a short link and reaching the destination. And a modest Buy Me a Coffee link in the header.
I asked a few SEO specialists I knew for advice. The responses weren’t encouraging: too difficult, almost impossible for a shortener, these sites never last, and so on. I’m still waiting for that meeting with one of them. :)
So I handled the SEO myself, using what little I knew. Google seemed to like my changes: impressions would creep up a few percent, giving me a reason to keep going.
## 12 circles of ping-pong hell
Things were going well. New visitors, returning visitors, more traffic to the site and through the short links. Then Google sent me a social engineering warning. Scammers had started putting my service to work. I blocked the offending links, requested a review, and the warning was gone the next day. I didn’t notice much of an effect on my search rankings.
I’d had an abuse report form from the start. People did write in, and I checked the sites and blocked the malicious ones. So GOOGLE itself “asking” me to remove a bad link wasn’t much of a surprise. I physically can’t check every link created on the service.
Then things got properly ridiculous. Looking through the stats one day, I spotted a link with traffic shooting up. The destination looked like a familiar gaming platform, but the domain was one letter off. I checked it, confirmed it was phishing, blocked it without mercy, and went to bed. By morning, around 20,000 visits had hit my blocked-link page instead.
Scammers blocked. I win. The platform’s users are safe!!!
Yeah, right. A little later, I found my site glowing RED on VirusTotal: flags from roughly 30 phishing databases and a few lesser-known antivirus vendors!
That caught me completely off guard. I had to do something: antivirus software and corporate firewalls could now block my links for legitimate users. The site was only a year and a half old. I was tempted to switch domains or just abandon the whole thing. But I also wanted to see if I could get out of this mess.
I hunted down email addresses, tried broken contact forms, and went round in circles with phishing databases. Twelve circles of hell: one database pointed to another, the second to a third, the third to a fourth, and the fourth back to the first. I ended up forwarding their emails to each other. They were playing ping-pong, and I was the ball. It felt endless, but I eventually got the flags down to eight. Those last eight simply wouldn’t reply.
I felt beaten up. I’d blocked the link and stopped 90% of its traffic from reaching the scam, yet keeping my own service alive had cost me a ridiculous amount of time, energy, and nerves.
While dealing with the VirusTotal mess, I started studying phishing patterns and building a simple, practical system to help me quickly spot suspicious sites, sometimes entire networks of malicious links.
After years of this, I can often spot a phishing site at a glance. Sometimes I feel like I’ve become a neural network for detecting and blocking malicious links.
## Unblock my link or else…
One fine day, my system flagged a particularly suspicious link. The site offered a file to download and strongly insisted that you disable your antivirus first. I clicked Block with equal conviction.
I’d already forgotten about it when, five minutes later, an email arrived in very broken English: why had I blocked their “beautiful” link? I pointed them to the rules and was about to get on with my day when another email came in: “I don’t care. Unblock my link right now! You’ll have problems.”
Entertaining, but the link stayed blocked. The threats eventually turned into pleading and tears. Meanwhile, day after day, the blocked-visit counter kept climbing.
The next surprise came through Buy Me a Coffee. Apparently, in desperation, the scammer decided $20 might change my mind. I refunded the money. The link stayed blocked.
By the way, that’s the only time anyone has ever sent me anything through Buy Me a Coffee.
## So what did I actually get out of it?
First, thanks for making it this far.
This kind of shortener barely earns anything, and monetizing it is harder than it looks. Maybe one day it’ll cover the hosting bill. When? Good question.
But I love this project. It’s an experiment that’s still running. Where else would I get to learn all of this?
Testing usability. Seeing people actually use a feature you thought up before falling asleep is a lovely feeling.
Optimizing a service to handle peaks of 200,000 visits a day on modest, though reliable, shared hosting.
Dealing with half a million bot requests a week and DDoS attacks.
Spotting phishing quickly and building tools to analyze suspicious sites.
Collecting analytics under load, without microservices.
Doing SEO beyond just the development side.
Even writing articles nobody reads. :) I put my own cybersecurity articles on the blocked-link pages, hoping for 10 readers per 1,000 visits. I got about five per 10,000.
A/B testing, and plenty more.
$19.56 from ads
Someone once offered to buy the service. But when I imagined what I’d do without all these experiments, I turned them down without even asking the price. :)
For me, the shortener has been about experience as a developer and beyond. Sometimes I even feel like a little internet Superman: 300,000 attempts to reach malicious sites stopped along the way.
Happy to answer questions when I can. For now, I’m off to build another feature and block some more malicious links.
