Is dub.sh legit or a scam?
Dub.sh is a legitimate link-shortening infrastructure operated by Dub Inc, trusted by major tech firms despite occasional abuse by third-party scammers.
Analysis Summary
No threats detected
All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →
Visual Screenshot Analysis
We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.
No scam visual patterns detected
The website displays a professional, fully-rendered landing page for a link management platform with no visual indicators of scamming or malicious intent.
What our vision model saw
6 signalsProfessional design with high-quality typography and consistent layout
Functional navigation menu with product, pricing, and enterprise links
Presence of legitimate customer logos at the bottom of the page
Standard SaaS call-to-action buttons for free trial and demo
Interactive link shortening tool demonstration with realistic UI elements
No urgency tactics, fake trust badges, or suspicious overlays detected
MT Intelligence
Our analysis confirms this domain is the primary shortening service for Dub.co, a well-established SaaS platform based in San Francisco. The site features professional design, transparent pricing, and a public GitHub repository with significant community backing. Although two antivirus engines (Criminal IP and VIPRE) flag the domain, these are likely 'reputation hits' caused by malicious actors using the service to hide phishing links. Independent review aggregators and business data show the company is a real entity with a verified team and high-profile customers like Vercel and Perplexity. We found no evidence that the platform itself is fraudulent; rather, it is a utility that requires standard caution when clicking user-generated links.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for dub.sh, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- dub.sh is the primary/default short link domain for Dub.co, a legitimate open-source link management, analytics, and affiliate platform founded in 2022 by Steven Tey in San Francisco.
- Used and trusted by major companies including Perplexity, Vercel, Framer, Twilio, Buffer, and Whop; powers 100M+ clicks with real customer testimonials on Product Hunt (5.0 rating) and their site.
- Scamadviser gives trust score 0/100 citing hidden WHOIS, shared low-review server, popular scammer registrar, and inability to analyze content; labels it "Very Likely Unsafe" (updated ~2 weeks ago).
- Gridinsoft gives 71/100 with mixed signals: domain age ~3-4 years, valid SSL, but 6 malware/phishing blacklist detections and low third-party reputation; some user reviews call it a "scum site" used in Steam phishing disguises.
- Dub.co maintains an abuse reporting form (dub.co/legal/abuse) and actively removes reported malicious/phishing short links; legitimate dub.sh links are sometimes blocked by browsers/ISPs due to prior abuse.
- Company has LinkedIn presence (5.7k followers), GitHub repo (dubinc/dub), rebranded to dub.co in 2023 while keeping dub.sh for short links; no formal business registration details (e.g. exact LLC filing) found in searches.
- Product Hunt, YouTube reviews, and Reddit mentions are predominantly positive for the link management tool; isolated complaints relate to affiliate credits or individual malicious uses of short links.
- Scamadviseropen
"The trust score of dub.sh is extremely low. This is a strong indicator that the website may be a scam."
- Gridinsoftopen
"It's a scum site. Disguised as a Steam gift under steamcommunity.com/gift/activation bastards, scammers. ... Scammers often disguise the link so it looks like the official domain, but it actually leads to a fake one Dub.sh."
- Gridinsoftopen
"We reviewed dub.sh and found a mix of positive and cautionary signals. The site does not currently look like a confirmed scam, but the evidence is not strong enough to treat it as fully established either. The current trust score is 71/100."
- Product Huntopen
"Reviewers describe Dub as a practical tool they rely on heavily for link tracking and redirects, especially for affiliate clicks and day-to-day link management."
- Trustpilot (via LinkedIn)open
"Love this 5-star Trustpilot review for Dub.co"
- dub.co (testimonials)open
"Dub is hands down the best" (Ian Mackey, VP Scicomm Media); "game-changer for marketing" (Johnny Ho, Co-founder Perplexity)"
Operated by Dub Inc / dubinc in San Francisco, CA; founded 2022 by Steven Tey (Founder & CEO); LinkedIn company page with 11-50 employees; open-source GitHub repo with customers including Perplexity, Vercel, Framer, Twilio.
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Domain & Encryption
Redirect Chain
- 1308http://dub.sh/
- 2403https://dub.sh/
Server Reputation
Still, stay alert
No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.
- Double-check the exact URL in your address bar
Confirm you are actually on dub.sh and not a lookalike like d-ub.sh.com or an IDN homoglyph.
- Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
- OpenDiscuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review found no threat indicators on dub.sh. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
- dub.sh passed our automated security checks with a trust score of 70/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
- Yes. dub.sh presents a valid TLSv1.3 certificate issued by Let's Encrypt · R13, expiring in 60 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- 2 out of 92 antivirus engines in our malware network flagged dub.sh as malicious or suspicious (2 outright malicious). Even one detection is a meaningful signal.
- No. dub.sh is not currently listed on the major browser blocklist feeds that modern browsers use.
- dub.sh resolves to an IP operated by Vercel, Inc in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- Yes. dub.sh sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.
- This is a permanent record of the scan run on June 24, 2026. The verdict and evidence above reflect that scan and do not change on their own. If circumstances around dub.sh have changed, MalwareTips staff can run a fresh scan, which re-runs every check from scratch and publishes an updated report.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.