I run a small URL shortener as a side project. Last week’s abuse sweep turned up a destination that had taken 89,826 clicks in 48 hours across three short links — more than everything else on the platform combined.

My scanner had scored it zero. The destination was an ordinary .com with a numeric path. Nothing to pattern-match on. I only found it because I sorted the database by click count instead of by suspicion score, which I’d never thought to do.

The destination cloaked on user agent:

That payload checked for Selenium/Puppeteer fingerprints, checked for an ad blocker, sampled 80 mouse positions to confirm a human, and fingerprinted GPU/screen/battery/timezone. If any check failed it played a success animation and then did nothing, so you never learn you were caught. I never reached the final page — it kept classifying me as not-a-victim.

I assumed the destination was the valuable thing, so I blocked it. Four hours later they were back with the same three short links, now pointing at two new domains that forwarded to the same place.

Fix: purged slugs are now reserved rather than released, and the reservation is written before the delete.

Full writeup with the timeline and telemetry: https://casparwre.de/blog/anatomy-of-a-scam-campaign/