Security, Abuse & Privacy

Automated Content Scanning

Definition

Where malware scanning asks whether a file is dangerous to run, automated content scanning asks whether the content breaks the rules. It covers several classes of check at once: brand impersonation and credential-harvesting layouts, content matched against hashes of known illegal material, spam and bulk-published near-duplicates, and simple structural signals such as a page whose only purpose is to forward visitors somewhere else. Checks run at upload, on publication, and periodically afterwards on what is already live. The output is a score or a label, not a verdict — most systems are tuned to hand anything ambiguous to a person rather than to delete it, because the cost of wrongly removing a legitimate business document is high.

Why It Matters

Free hosting attracts abuse, and a host that does not filter ends up on browser and email blocklists that punish every legitimate user of the same domain. Filtering, though, means some honest files get caught. A login-styled mockup, a security training deck full of fake credential screens, a template with placeholder bank details — all look, to a classifier, much like the thing it is trained to stop. Understanding that means understanding the recourse: a held file is normally pending, not deleted, and stating plainly what it is and who it is for is what moves it along. Publishing a page that simply bounces visitors elsewhere is the pattern most likely to be held, so a real landing page beats a redirect shim.

How It Works

A submitted file is typed, hashed and, where it is a web page, parsed. Text and visible structure are compared against classifiers for the abuse categories a host enforces; images may be hashed with a perceptual hash so that near-copies of known material match. Signals also come from the account and the publishing pattern rather than the file — how many sites were created in an hour, whether the content is a near-duplicate of dozens of others. A clear pass publishes normally; a borderline score routes to human review, with the address held and the uploader notified; a definite match refuses the upload and logs it. Reports from the outside feed the same queue: an abuse report about a live page joins the human review path directly.

Real-World Example

A security consultant publishes a phishing-awareness training deck to 99helpers, containing screenshots of fake sign-in pages used in staff exercises. The publish is held for review, because those screenshots look exactly like what the classifier exists to catch. The consultant replies with the context — internal training, hosted for their own staff, no live form on the page — and the site goes live within the review window, with a note on the account so similar future uploads are handled faster.

Common Mistakes

  • Treating a hold as a ban — a held file is usually waiting for a person to look at it, and silence from the uploader is what keeps it waiting
  • Republishing the same content under a new name after a hold instead of answering the notice, which reads as evasion and widens the action
  • Publishing a page whose only content is a redirect to another address — that is the single most flagged shape on any free host
  • Assuming a scanner understands intent, when it only recognises shapes that resemble things it was trained on

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →