How file hosts scan uploads for malware, phishing and illegal content
What happens when you upload a file
File hosts scan uploads in layers. They accept only an allowlist of file types and check each file's real format from its first bytes, look the file up against known-malware lists, check links and web pages for phishing, run AI classifiers over images and video frames, and compare images against fingerprints of known child abuse material held by child-protection organizations. Anything flagged goes to a human reviewer, and a Report button lets anyone flag what the machines miss.
At a glance
- First gate
- File-type allowlist, checked by the file's real bytes
- Malware
- Known-malware lookups and antivirus scans
- Phishing
- Links checked against unsafe-site lists; pages scanned
- Images and video
- AI classifiers, video checked frame by frame
- Known abuse images
- Hash matching against child-protection lists
- People
- Human review of flags, plus user reports
What does each layer of scanning do?
Allowlists and magic-byte checks
The cheapest and strongest check comes first: only accept file types the host knows how to serve safely, and refuse programs outright. Hosts do not trust the file name or the type the browser reports, both of which are easy to fake. They read the magic bytes at the start of the file, which reveal what it really is, so a program renamed to look like a PDF is caught before it is stored.
Malware lookups
A host can compute a short fingerprint (a hash) of each file and ask a malware database whether it has seen that exact file before. That is fast and private, because only the fingerprint leaves the host. Many also run the file through an antivirus engine, which can spot known families of malware even when the exact file is new.
Phishing checks
Phishing on file hosts usually looks like a fake sign-in page or a PDF with a "view document" button pointing somewhere nasty. Hosts pull the links out of documents and check them against lists of unsafe sites, scan uploaded web pages the way a security researcher would, and run text classifiers that recognise the wording of credential lures.
AI image and video classifiers
Machine-learning models score images for categories such as sexual content, violence and self-harm. Video is handled by sampling frames and checking each one as an image. Classifiers are good at volume and bad at nuance, so a responsible host treats a high score as a reason for a person to look, not as a verdict.
Known-CSAM hash matching
For child sexual abuse material, the industry relies on hash lists maintained by child-protection organizations. In the US, NCMEC adds the fingerprint of each confirmed image or video to a list that companies can use, voluntarily, to find copies on their own systems. Perceptual hashes also match images that were resized or re-saved. A match means the file is removed, evidence is preserved as the law requires, and the account is reported: US providers must report apparent CSAM they become aware of to NCMEC's CyberTipline.
Human review and user reports
Automated checks feed a queue that people work through. Reviewers confirm real abuse, release false positives and ban repeat offenders. Reports from the public cover the gap the machines leave: brand-new material, scams written in plain language, and content that is only harmful in context.
What can each layer catch, and what does it miss?
| Layer | Good at | Misses |
|---|---|---|
| Allowlist and magic bytes | Programs and disguised file types | Harmful content in an allowed type |
| Malware lookups | Files already known to be malicious | Brand-new or one-off malware |
| Phishing checks | Known bad sites, classic lure pages | Brand-new domains, clever wording |
| AI classifiers | Large volumes of images and video | Context; makes false positives |
| Known-CSAM hash matching | Copies of confirmed abuse images | New material with no fingerprint yet |
| Human review and reports | Judgement and context | Speed at scale |
How does Link in Seconds scan uploads?
We use the same layered approach, at upload time and again in scheduled re-scans. Our Trust and Safety page lists the providers involved: OpenAI, Google Cloud Vision, Google Web Risk, a phishing text classifier, a ClamAV malware scan, abuse.ch malware lookups and a urlscan.io check of new HTML pages. The privacy policy says exactly what each one receives.
- Allowlist first. Only supported file types are accepted, each checked by its real bytes. Programs and scripts are always blocked.
- Held, not published. When a check flags an upload, the link is held and not shown to anyone until a person has reviewed it.
- Uploaded web pages are contained. HTML runs in a sandboxed frame, and shared files open on a separate domain from your account, so a hostile page cannot read your sign-in. New accounts wait 6 hours before their first HTML upload.
- Anyone can report. Every shared page has a Report button, no account needed. Confirmed abuse is taken down and serious or repeat offenders are banned.
- Zero tolerance for child abuse material. Our child safety policy explains how we detect, remove, preserve and report it to the authorities.
- No AI training. Uploads are scanned only to keep the service safe, never to train any model.
Quick answers
Do file hosting sites scan your files?
Most public file hosts do. Typical checks are a file-type allowlist, a malware lookup, a phishing check of links and pages, AI classifiers for images and video, and matching against lists of known illegal images. Flagged files go to people for review, and anyone can report a link.
How do file hosts detect child sexual abuse material?
Mainly by hash matching. Child-protection organizations such as NCMEC keep lists of fingerprints of confirmed abuse images, and companies can use those lists to find exact and near copies without anyone viewing the file. In the US, providers must report apparent CSAM they become aware of to NCMEC's CyberTipline.
Can a scan catch everything?
No. Scanning is a safety net, not a guarantee. New material has no known fingerprint, classifiers make mistakes in both directions, and that is why human review and user reports matter as much as the automated checks.
Does scanning mean the host reads my files?
Automated systems do look at them, and on most hosts stored files are not end-to-end encrypted. A good host says which safety providers receive what, and promises not to train AI on your files. Do not put sensitive information behind a public link.
Why was my upload held for review?
An automated check flagged something, and the host is waiting for a person to look. Classifiers are cautious, so a held file does not mean you did anything wrong. On Link in Seconds the link goes live once it clears, and you are told if it does not.
Go deeper
Turn any file into a link in seconds
Upload a PDF, image, video, or ZIP and get a clean, trackable link with a QR code, free.
Try Link in Seconds →