Skip to content
RouteSeam

Abuse and safety

A hosted-redirect service can be misused as phishing infrastructure: register a lookalike domain, point it at a credential harvester, and the redirect provider lends the scheme credibility. RouteSeam treats abuse prevention as a first-class product requirement, not an afterthought. This page covers the built-in protections, how anyone can report an abusive redirect, and what happens afterward.

Built-in protections

Section titled “Built-in protections”

Before a domain can serve traffic, RouteSeam already gates it:

  • Domain ownership verification — a domain only activates after its DNS points at RouteSeam, so you cannot claim or redirect a hostname you do not control.
  • Destination validation — destinations must be valid HTTP/HTTPS URLs, and known-malicious destinations are detected and rejected.
  • Loop protection — configurations that redirect back into themselves are refused; see redirect types.
  • Account rate limiting — creation and change operations are rate-limited to slow bulk abuse.
  • No hostname hijacking — a hostname that is already claimed by another customer cannot be taken over.

These stop most abuse before it starts. The reporting flow handles the rest.

Reporting an abusive redirect

Section titled “Reporting an abusive redirect”

Anyone — you do not need an account — can report a RouteSeam-hosted redirect through the public form at /report on the RouteSeam site. Describe what the redirect does and why it is abusive (phishing, malware delivery, deceptive destination, and so on). Submitting the form lands the report in RouteSeam’s internal review queue, and the reporter sees a confirmation page.

What happens after a report

Section titled “What happens after a report”

Every report enters the admin abuse queue, where RouteSeam staff investigate:

  1. Review. An admin inspects the reported domain: its state, destination, DNS check history, and related activity.
  2. Outcome. The report is either dismissed (no violation found) or resolved with action — up to and including suspending the domain. For patterns of abuse, the owning organization can be suspended as well.
  3. Audit trail. The investigation and the action taken are recorded in the audit log.

Suspending an organization removes its routing configuration from the edge, so all of its domains stop redirecting — not just the reported one.

What suspension means for traffic

Section titled “What suspension means for traffic”

A suspended domain’s redirect is removed from the edge configuration. Visitors to the hostname no longer reach the destination; they see a suspension interstitial — a minimal, RouteSeam-branded page — instead of a redirect. The domain’s status shows Suspended in the dashboard.

Suspension is deliberately different from quota warnings or billing states: those never break redirects, but abuse suspension is designed to stop traffic immediately. The domain cannot serve redirects again until it is explicitly unsuspended.

Owner notification, appeal, and resolution

Section titled “Owner notification, appeal, and resolution”

If one of your domains is suspended:

  • You are notified and the domain shows as Suspended in your dashboard.
  • If you believe the suspension is a mistake, appeal by contacting RouteSeam — explain the redirect’s purpose. Reports can be wrong, and legitimate security research, URL shorteners, and parked-domain setups sometimes look suspicious from the outside.
  • If the issue is fixable — for example a destination that was compromised and has been cleaned, or a redirect you did not intend — fix the destination and ask for re-review.

When a suspension is lifted, the domain returns to DNS Pending rather than straight to Active: RouteSeam re-verifies DNS and re-provisions TLS before traffic flows again. Expect the same short progression as a fresh setup — see DNS and TLS and the domain lifecycle.

Section titled “Related pages”