I run a free URL shortener on the side. Someone did 90k scam clicks in 48 hours.

I already have my main products (KeepTheScore etc.). On the side I run zip1.io — a free URL shortener with no signup. It costs me about $27/month and makes $0. I forked an open-source project, put a domain on it, and mostly leave it alone except for weekly abuse sweeps.

Last week’s sweep found a destination that had taken about 90,000 clicks in 48 hours. More than everything else on the site combined. I deleted the links. Two minutes later they were back.

What followed was three rounds of delete-and-recreate. Because zip1 lets people pick custom slugs, the operators kept reclaiming the same short URLs that were already circulating on Facebook. Deleting wasn’t enough until I started reserving burned slugs so the old posts just 404.

The technical bit that surprised me: the same destination returned three different pages depending on how I fetched it — desktop browser, datacenter server, or Android inside the Facebook app. One of them fingerprinted the device and, if you looked like a bot, played a success animation and then did nothing. Quietly. No error.

I wrote the full post-mortem here (cloaking, who was clicking vs who was creating the links, how reserved slugs fixed the loop):
https://casparwre.de/blog/anatomy-of-a-scam-campaign/

If you run anything with public create / no auth / custom IDs, I’d be curious how you handle the third round of “they’re back.”