Is there a convention or safeguard to show malicious URLs in a paper if they are relevant to the topic? Some PDF viewers parse the text for URLs, which makes removing the hyperlink alone insufficient. How can (accidental) clicking be prevented?


1 Answer 1


Back in 2017 there was an IETF Internet-Draft draft-salgado-hxxp-01 for The "hxxp" and "hxxps" URI Schemes, which I think was a pretty good suggestion.

This document describes the "hxxp" and "hxxps" URI schemes, which are widely used by the security community to obfuscate an http or https URI to avoid being accidentaly interpreted and loaded by a web browser or user-agent.

These schemes are used in case the resource is dangerous and there is security risks on being automatically processed by an application, such a pre-loading mechanism in web user agents. It also prevents the creation of "clickables" areas in user interfaces, which could detect http or https URIs automatically.

Replacing http(s):// with hxxp(s):// does exactly what you want, and is also widely used already, so anyone in the field knows the purpose. Visiting the URL requires the voluntary action of editing the protocol back to its original.

However, if the paper is a publication, the malicious URLs might be too ephemeral to be published even as sanitized URLs. The malicious content could, e.g., be on a compromised site and be cleaned in a while. It is part of research ethical consideration to think how this could affect the sites reputation. In this case, if the pattern of the URL is relevant for describing the phenomenon, the domain part could also be replaced with RFC 6761 Special-Use Domain Names like example.com, or the protocol and domain could be omitted altogether, only publishing the /path/path?query=query#fragment (RFC 3986, 3).

  • 1
    hxxp is only safe if the reader is not (too) clever enough to do domain suffix parsing. It can get much worse if fragments of the paper are being sent in other methods (IM, email). For really unwanted links, some prefer to hide the dots in the domain names, like example[.]org.
    – chexum
    May 15, 2022 at 6:56
  • It might be worth to mention that the cited draft expired 5 years ago, i.e. that it should only be taken as an inspiration but by no means as consensus or even standard. May 15, 2022 at 7:13
  • @SteffenUllrich: Good point; I've clarified this & emphasized my main point of not publishing the full URLs in the first place. May 15, 2022 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .