How GlaCat blocks phishing and malicious short links

GlaCat runs a safety check on every short link as it is created, and re-scans existing links every hour. Links judged to be phishing or malicious are refused at creation or taken down automatically — no human review needed first.

Checked at creation, not cleaned up afterwards

Most URL shorteners only deal with a bad link once somebody reports it. GlaCat works the other way round: the moment you press "Create short link", the destination has to pass a safety check before any short code is issued. If it fails, no link is created at all and the page tells you exactly why.

• Heuristic rules: block links that use a bare IP address as the host, URLs carrying credentials in userinfo form (such as https://user:pass@host), non-standard ports, and nested redirects pointing at other URL shorteners — including GlaCat itself, so links cannot be chained indefinitely.
• Google Safe Browsing: checked against the phishing and malware database Google maintains.
• abuse.ch URLhaus: checked against community-reported malware distribution URLs.

If an external intelligence service is temporarily unreachable, the system fails open: an outage never blocks legitimate users, but the heuristic rules always apply.

Existing links are re-scanned every hour

URLs change. A page that is clean today can be compromised into a phishing page tomorrow. GlaCat runs an hourly background job that re-scans existing URL links in batches. Any link that now fails is disabled immediately — the short URL stops redirecting from that point on — and it appears in the admin review queue.

Abuse control: rate limits and account quotas

Mass-producing phishing links is a common attack pattern, so GlaCat also limits how fast links can be created: 20 per hour anonymously and 100 per hour when signed in, per source IP (compared as a salted hash — the plain IP is never stored). Signed-in accounts have an additional cap of 300 links per day, which stops an attacker from signing in and rotating IP addresses to get around the limit. Anonymous creation always requires passing a Cloudflare Turnstile challenge.

Custom short codes are currently disabled, so nobody can squat a brand name or an official-looking code to make a scam more convincing.

Reporting and 24-hour takedown

If you find a link starting with glacat.com that points to phishing, fraud or illegal content, email report@glacat.com with the full short URL. We commit to handling it within 24 hours, and reports involving intimate imagery or child protection are prioritised. Every takedown and deletion performed from the admin side is written to an audit log, so the record is available if law enforcement needs it.