{
  "id": 8270799,
  "title": "Anatomy of a scam campaign, from the point of view of a link shortener",
  "url": "https://urgent.news/2026/09/18/anatomy-of-a-scam-campaign-from-the-point-of-view-of-a-link-shortener",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T16:34:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/caspii/anatomy-of-a-scam-campaign-from-the-point-of-view-of-a-link-shortener-297j"
  },
  "original_language": "en",
  "account": "A free link shortener operated by the author became a target for a scam campaign. Over 75,000 links were stored in the database, with one destination, hai8g.com/4/11395320, receiving over 89,000 clicks in just 48 hours. The link shortener's creator observed the operation, noting how the links concealed their malicious intent, the traffic source, and the final destination.\n\nThe scan process involved checking for cheap domains, brand names in odd places, nested shorteners, and paths that resembled login or phishing pages. The author manually fetched the destination from different sources and found that the link redirected to either google.com, yahoo.com, or returned 42,748 bytes of scrambled code. The scrambled code checked for fingerprints, confirmed a real user, and played a congratulatory animation if any of the checks failed, without revealing the user had been caught.\n\nThe campaign reused links by adding an extra hop in the middle and reserving the same slug. The creator implemented a system to reserve burnt slugs to prevent reuse and avoid the same issue. Facebook was the primary source of clicks, with users primarily from Spanish-speaking countries in Latin America. The author emphasizes the importance of create-time checks and reserving slugs to prevent such campaigns from reusing the same links.",
  "summary": "I run a free link shortener as a side project. A few thousand people use it a day, and about 75,000 links sit in the database. Once a week I go through them looking for the ones that are up to no good. Last week’s sweep turned up one destination that had taken 89,826 clicks in 48 hours . More than everything else on the site combined. I deleted the links from the database. Two minutes later, they…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}