What is a safe way to display malicious URLs in research PDFs?

Question

Is there a convention or safeguard to show malicious URLs in a paper if they are relevant to the topic? Some PDF viewers parse the text for URLs, which makes removing the hyperlink alone insufficient. How can (accidental) clicking be prevented?

Answer 1

Back in 2017 there was an IETF Internet-Draft draft-salgado-hxxp-01 for The "hxxp" and "hxxps" URI Schemes, which I think was a pretty good suggestion.

This document describes the "hxxp" and "hxxps" URI schemes, which are widely used by the security community to obfuscate an http or https URI to avoid being accidentaly interpreted and loaded by a web browser or user-agent.

These schemes are used in case the resource is dangerous and there is security risks on being automatically processed by an application, such a pre-loading mechanism in web user agents. It also prevents the creation of "clickables" areas in user interfaces, which could detect http or https URIs automatically.

Replacing http(s):// with hxxp(s):// does exactly what you want, and is also widely used already, so anyone in the field knows the purpose. Visiting the URL requires the voluntary action of editing the protocol back to its original.

However, if the paper is a publication, the malicious URLs might be too ephemeral to be published even as sanitized URLs. The malicious content could, e.g., be on a compromised site and be cleaned in a while. It is part of research ethical consideration to think how this could affect the sites reputation. In this case, if the pattern of the URL is relevant for describing the phenomenon, the domain part could also be replaced with RFC 6761 Special-Use Domain Names like example.com, or the protocol and domain could be omitted altogether, only publishing the /path/path?query=query#fragment (RFC 3986, 3).