// KEYLOGGER.LOL

// QUICK START

Create a redirect

curl -X POST https://keylogger.lol/myproject \
  -H "Content-Type: application/json" \
  -d '{"target": "https://raw.githubusercontent.com/you/repo/main/install.sh"}'

Use the redirect

curl -fsSL keylogger.lol/myproject | bash

That's it. No account needed. No API keys. Just POST and go.

// API REFERENCE

{
  "target": "https://raw.githubusercontent.com/owner/repo/branch/file.sh"
}

{
  "ok": true,
  "path": "/myproject",
  "target": "https://raw.githubusercontent.com/..."
}

// PATH RULES

Paths must be:

• •Lowercase — automatically normalized
• •Alphanumeric — letters, numbers, hyphens, underscores, slashes
• •Under 200 characters
• •No .. sequences — path traversal is blocked

Valid examples:

• • /install
• • /my-project
• • /org/repo
• • /v2/setup

Invalid examples:

• • /My Project — spaces not allowed
• • /setup.sh — dots not allowed
• • /../etc/passwd — nice try

// ALLOWED TARGETS

Only GitHub URLs are permitted:

• • https://github.com/*
• • https://raw.githubusercontent.com/*

Attempting to create a redirect to any other domain returns 403 Forbidden.

This isn't a general URL shortener. It's specifically for sharing GitHub-hosted scripts and files.

// USAGE EXAMPLES

With curl

curl -fsSL keylogger.lol/install | bash

With wget

wget -qO- keylogger.lol/install | bash

Nested paths

# Organize by owner/repo
curl -X POST https://keylogger.lol/dschreck/dotfiles \
  -H "Content-Type: application/json" \
  -d '{"target": "https://raw.githubusercontent.com/dschreck/dotfiles/main/install.sh"}'

# Then use it
curl -L keylogger.lol/dschreck/dotfiles | bash

In HTML

<script src="https://keylogger.lol/analytics"></script>

// TECHNICAL DETAILS

Architecture

The service runs entirely on Cloudflare's edge network as a Worker, meaning requests are handled at the closest data center to the user. No backend servers, no databases, no proxies.

Storage (Cloudflare KV):

• •REDIRECTS — User-created redirect mappings (path → target URL)
• •RESERVED — Reserved paths managed separately
• •BADWORDS — Blocklist for inappropriate path names

Request Flow

Creating a redirect (POST /path):

1. 1.
   Path Normalization

   • NFKC Unicode normalization (converts fancy characters to standard equivalents)
   • Convert to lowercase
   • Remove leading/trailing slashes
   • Validate: max 200 chars, alphanumeric + hyphens/underscores/slashes only
   • Block path traversal attempts (.. sequences)
2. 2.
   Path Analysis

   • De-confusables: Replace lookalike characters (e.g., h4te → hate)
   • Sanitize: Strip non-alphanumeric characters for blocklist checking
   • Check against BADWORDS KV namespace
   • Reject if flagged
3. 3.
   Target Validation

   • Must start with https://github.com/ or https://raw.githubusercontent.com/
   • Reject all other domains with 403 Forbidden
4. 4.
   Storage

   • Check if path already exists in REDIRECTS KV (returns 409 Conflict if claimed)
   • Store as JSON: { target: string, created_at: number }
   • Return 201 Created with redirect details

Following a redirect (GET /path):

1. 1.
   Lookup

   • Check RESERVED KV namespace first (for reserved paths)
   • Fall back to REDIRECTS KV namespace
   • Return 404 Not Found if neither exists
2. 2.
   Validation

   • Parse stored JSON record
   • Re-validate target URL (must still be GitHub)
   • Return 410 Gone if target is no longer allowed
3. 3.
   Redirect

   • Return 302 Temporary Redirect with Location header
   • Browser/client follows redirect to GitHub
   • No content proxied, no injection, no logging

Special Endpoints

• •GET / — Returns usage instructions (plain text)
• •GET /stats — Returns redirect counts from KV (JSON: { redirects, reserved, total })
• •First-party redirects — Specific hostnames (e.g., github.keylogger.lol) redirect to hardcoded targets

Security Features

• •Path filtering: Blocklist system prevents inappropriate path names
• •Target restriction: Only GitHub URLs allowed (no arbitrary redirects)
• •Path normalization: Prevents Unicode homoglyph attacks and confusables
• •No content proxying: Users hit GitHub directly after redirect (transparent)
• •302 redirects: Temporary redirects show final URL in browser network tab

Privacy

The service is a thin redirect layer. We don't:

• •Proxy or cache content
• •Log individual requests (no request/response logging)
• •Inject scripts or modify responses
• •Store analytics or tracking data

Users hit GitHub directly after the redirect. The Worker only performs the lookup and returns the redirect header.

// FAQ

// SOURCE CODE

This project is open source:

GitHub: github.com/dschreck/keylogger-lol

Built with Cloudflare Workers. PRs welcome.

// © 2026 keylogger.lol