QR codes in images
livewells reads QR codes in images. A QR code is a square picture that holds text, most often a web address. Attackers print a malicious address as a QR code so that a mail filter cannot read it.
Send an image
Send a PNG or JPEG image on the Upload a file tab, or through the API.
livewells also reads QR codes in images inside another item of the same case:
- images in the body of an email,
- image attachments in an email or an archive,
- the page images of a PDF.
For GIF, WebP and BMP images, the report says that livewells reads PNG and JPEG images. Convert the image to PNG and send it again.
What you see
- The image type and size, and how many codes livewells found.
- A table with one row for each code: its number, its kind, its place in the image and its content.
- Each web address (
httporhttps) as an item that you can send to the disposable browser with one click. - Every other content as text. Examples are a mail address, a phone number, a Wi-Fi sign-in and plain text.
- Flags in plain words. The table at the end of this page lists them.
livewells finds a code that is turned, mirrored, printed in light on dark, small, blurred or noisy. It reads up to 20 codes in one image.
Every address in the report is defanged. For example, an address appears as hxxps[://]login[.]example[.]com/verify. You choose when to open a web address.
Kinds of content
| Kind | What livewells does |
|---|---|
Web address with http or https | Lists it as a link for the browser. Lists the host as an indicator. |
Address with javascript:, data:, file: or another scheme that starts a program | Shows it as text with a high flag. |
| Mail address | Shows the text and lists the address as an indicator. |
| Wi-Fi sign-in | Shows the network name and security type. The report says whether a password is present. |
Site name without a scheme, such as www[.]example[.]com | Lists the name as an indicator and raises a flag. |
| Phone number, text message, contact card and other text | Shows the text. |
Characters that hide or reorder text appear as [U+202E]-style codes, and livewells raises a flag.
Limits
| Limit | Value |
|---|---|
| File size | 25 MiB |
| Image size | 24 million pixels, and 20,000 pixels on one side |
| Codes reported | 20 in one image |
| Link length | 2,048 characters. A longer address appears as text with a flag. |
| Time | 30 seconds for one image |
When an image is over a limit, the report says so. The report states that the image holds no code only when livewells read all of the image.
Flags
| Level | What livewells tells you |
|---|---|
| high | A QR code holds an address that starts a program or runs script. Do not open it. |
| medium | This image is too large to read. livewells did not look for QR codes. |
| medium | A QR link has a user name in front of the host. This can hide the real site. |
| medium | A QR link uses a host name in a coded form that can imitate a known name. |
| medium | A QR code holds characters that hide or reorder text. |
| low | livewells did not read all of this image. A QR code may be in the part it did not read. |
| low | This image is damaged or cut short. livewells could not read all of it. |
| low | This image has extra data after its end. |
| low | A QR link goes to a number address, not to a name. |
| low | A QR code holds much more text than a normal link. |
| low | A QR code holds a site name without a scheme. A phone can open it as a link. |
| low | A QR link carries a second address in its query. |
| low | This image holds more QR codes than livewells reports. |
| low | A QR code sets up a Wi-Fi network. |
| info | livewells reads QR codes in PNG and JPEG images only. |
| info | This image holds a QR code. |
| info | livewells found no QR code in this image. |