Security & Abuse Prevention
We take link integrity and user safety seriously. Here is an honest, technical explanation of the security systems safeguarding every redirect on ul0.
1. Mandatory TLS / HTTPS
All traffic to ul0 and customer custom domains is strictly encrypted with modern TLS 1.3 encryption. HTTP Strict Transport Security (HSTS) with a 1-year max-age is enforced across all endpoints.
2. SSRF & Private IP Blocking
Our backend server-side validation strictly prohibits shortening or inspecting private intranet IP ranges (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16, AWS metadata 169.254.169.254, and IPv6 loopback addresses).
3. Brand Mimicry & Phishing Heuristics
Link submissions are checked in real-time against heuristics for brand spoofing (e.g. fake PayPal, Apple, Chase, or Google authentication forms on disposable TLDs). Suspicious URLs are automatically rejected.
4. Privacy-First Telemetry
Click analytics use anonymized telemetry (aggregate country codes and device categories). We never sell user data, record personal PII, or install third-party advertising tracking pixels on redirects.
Threat Intelligence Radar
Explore our public transparency database of intercepted phishing campaigns, brand impersonators, and banned scam domains. Zero redirects and zero search engine backlinks are passed to attackers.
Spam & Phishing Takedowns
Found a short link being used for malware, credential harvesting, or spam? We disable confirmed malicious slugs immediately.
