Abuse policy: how gc.mw links are checked and disabled

What may not be linked from gc.mw is set out in the acceptable use policy. This page is about the machinery: how a link is checked, what a report does, and how a decision is reversed.

Report a link at gc.mw/report, or write to abuse@gc.mw with the short link and a sentence about the problem.

Checks when a link is created

Before a link is issued, the destination is validated synchronously. Only http and https are accepted. Destinations that resolve to private, loopback or link-local addresses are refused, as are links pointing back at gc.mw itself, and hosts on the configured block list. A refusal at this stage returns an error to the person creating the link; nothing is stored.

The link is then assessed in the background, off the request that created it. That assessment resolves the destination's redirect chain up to three hops and checks every hop, not just the URL that was typed, because a clean first URL that lands somewhere else is the oldest trick in the book. Each URL is checked against the reputation providers that are switched on — URLhaus and the Spamhaus domain block list by default, and Google Safe Browsing where an API key is configured. Verdicts are cached for 24 hours so a popular destination is not re-queried on every link.

The worst verdict wins. A malicious verdict blocks the link. A suspicious verdict flags it. A destination that redirects into a private address is treated as suspicious on its own.

Checks on a schedule

A sweep runs hourly and does three things.

It re-checks links that are getting real traffic — more than 100 clicks — whose verdict is more than 24 hours old, oldest first. Abuse is often staged: a harmless page today, a credential form once the link has circulated.

It assesses links the create-time check never reached, because a process restarted or an event handler failed. Links younger than ten minutes are left alone so the two do not race.

It escalates. A link the pipeline flagged that nobody has reviewed within 48 hours is upgraded from flagged to blocked. Links flagged by human reports are excluded from that escalation — those wait for a person, because a report is a claim and not yet a verdict.

What a report does

Anyone can report a link, with or without an account. The form is rate limited to five reports an hour per address, carries a hidden honeypot field, and requires a Cloudflare Turnstile challenge where one is configured.

The response is the same whether or not the code exists. That is on purpose: an endpoint that says "no such link" is an endpoint for enumerating other people's codes.

Reports from the same reporter about the same link inside 24 hours are treated as one. When two distinct reporters have an open report against a working link, it is flagged automatically — it stops redirecting at that moment — and it enters the review queue. The cost of being briefly wrong about a legitimate link is much smaller than the cost of leaving a phishing page live for a day.

Each automated flag or block also writes its own entry into the queue, with the provider and the reason, so a reviewer sees the evidence beside the link.

What a disabled link does

It stops redirecting. Visitors get a page saying the link was disabled after a report or a safety check, answered with HTTP 410, carrying a link to the report form. It does not silently 404, and it never forwards to the destination while it is under review. The block takes effect across the caches immediately.

The link and its history are not deleted. An owner whose appeal succeeds gets the same code back with its statistics intact.

Review, restore and appeal

Every flagged and blocked link sits in a queue with its open reports. A reviewer can re-check it against the providers on demand, block it, or restore it.

A restore sets the link active, records the verdict as reviewed by a person, and closes the open reports against it. That review is pinned: the scheduled sweep skips links a person has cleared, so a false positive does not come back tomorrow.

To appeal, write to abuse@gc.mw with the short code and where the link was meant to go. Automated blocks are wrong sometimes — a new domain with no reputation, a marketing platform other people have abused, a URL shape that resembles a known campaign — and those are the ones that get restored quickly.

Workspaces

A workspace that is used for abuse can be suspended, which blocks every one of its active links at once. Lifting a suspension does not automatically un-block those links: each was blocked for a reason and is restored individually after review.

What we promise about timing

Reports are read by a person, not only by a queue. A report that reaches the automatic threshold takes effect immediately, without waiting for that reading. Our targets: reports from security teams, mail providers and reputation services answered within one business day; phishing, malware and child sexual abuse material acted on as fast as we can confirm them, ahead of everything else; appeals answered within one business day.

Child sexual abuse material is reported to the authorities, not merely blocked, and there is no appeal.

Where this pipeline is not yet complete

Stated so nothing above is read as a claim about behaviour that does not exist. Google Safe Browsing runs only where an API key is configured; without it the reputation check is URLhaus and the Spamhaus block list. The per-account creation velocity rules described in our engineering plan are written but not yet wired into link creation; today the limits in force are the per-address rate limits, including ten anonymous links an hour per address.