Trust & Security Architecture

Arsitektur Keamanan & Penanganan Penyalahgunaan

Technical documentation of our multi-layered defenses, threat intelligence integrations, real-time click-interception policies, and cooperation framework for cybersecurity vendors and anti-phishing organizations.

Report Phishing or Abuse Verify / Unshorten Link security.txt (RFC 9116) About Our Service
Vendor Notice

Root Domain vs. Path-Level Content

kua.lat is a shared Software-as-a-Service (SaaS) routing utility. Like other URL shorteners, destination content is independently managed by third-party creators.

Scope URI Pattern Evaluation Guidance
Apex Root Domain https://kua.lat/ Hosts benign service infrastructure: user dashboard, API v2, documentation, and the safe link verification tool. The apex domain does not host or distribute malicious payloads. Do not blocklist the apex domain.
Individual Shortlink https://kua.lat/{alias} User-generated redirect. When abuse occurs, please add the specific offending path to blocklists and notify our abuse desk for immediate takedown.
Blocklisting Recommendation: We ask threat intelligence providers (Google Safe Browsing, Netcraft, PhishTank, Spamhaus, VirusTotal, and Microsoft SmartScreen) to target specific path-level URLs rather than penalizing the apex domain (kua.lat). Flagging the root domain disrupts legitimate services for all users, whereas reporting individual paths triggers our automated takedown mechanisms immediately.

Six-Layer Defense Architecture

Every short link on kua.lat passes through validation, automated threat intelligence, and click-time monitoring.

1
Protocol & Trust Validation

Restricts URL schemes to http, https, and ftp only. Dangerous protocols (javascript:, data:, file:) are rejected. Loopback hosts (127.0.0.1, localhost) and private RFC 1918 subnets are blocked to prevent Server-Side Request Forgery (SSRF). Self-shortening loops are denied.

2
Third-Party Threat Feeds

Target destinations are scanned against threat intelligence feeds: Google Safe Browsing and Web Risk for malware, PhishTank for active phishing lures, and VirusTotal for multi-engine reputation checks. Detected threats are rejected upon creation.

3
Proactive Blocklists

We maintain dynamic blocklists covering prohibited domains and keywords (including unlawful gambling, financial scams, credential harvesting, and suspicious TLDs). Any submission containing blacklisted tokens is blocked immediately.

4
Click-Time Protection Gates

Redirections are evaluated dynamically at click time. If a link is disabled, reported, or newly recognized as harmful, the engine halts the redirect, sets an HTTP 410 Gone response code, and displays an interstitial warning gate to protect the visitor.

5
Automated Background Scans

A scheduled batch auditor (cron:urls) re-evaluates active links against external threat feeds. This catches external websites that were clean when shortened but later compromised or repurposed.

6
Public URL Inspection Tool

End users and security researchers can use our inspection tool at /verify/links to reveal the destination URL safely without triggering redirects or exposing client telemetry to the target server.

Penanganan Penyalahgunaan & Takedown Cepat

When an abuse report is confirmed through our reporting channels, our moderation pipeline enforces swift four-stage remediation:

1. Immediate Deactivation (HTTP 410 Gone)
The shortlink is disabled immediately. Any subsequent click displays an interstitial warning gate instead of redirecting.
2. Permanent Blacklisting
The target URL and host domain are added to persistent banned tables (banned_urls and banned_domains), preventing any future shortening.
3. Account Enforcement
Accounts deploying malicious campaigns are permanently suspended and their active links are invalidated.
4. Audit Trail & Incident Record
The submission, timestamps, and reporter reference are logged in our reports repository for compliance and threat intelligence telemetry.

Official Security & Abuse Channels

Cybersecurity vendors, CERTs, registrars, and researchers can reach our operations team directly through these verified channels:

Channel Endpoint / Details
Abuse Mailbox [email protected] For phishing, malware, scams, and automated threat feeds.
Web Portal https://kua.lat/report Structured web reporting form with reason classification.
General Inquiries [email protected] Administrative, legal, and partnership communications.
RFC 9116 /.well-known/security.txt Standardized machine-readable security policy.

Need to verify or report a link right now?

We provide instant self-service tools for end users and automated channels for threat intelligence researchers.

Submit Abuse Report Periksa URL Tujuan Tentang Platform Kami