Trust & Safety at QRLynx

Our commitments

QRLynx is a SaaS QR code platform operated by Jorbox LLC. Every dynamic QR we issue routes through a redirect domain we control, which means we have both the responsibility and the technical ability to act on abusive QR codes within minutes of confirmation.

This page documents our public commitments so security researchers, anti-phishing organizations, victims of QR-based scams, and Cloudflare\u0027s trust & safety team can route reports to us with confidence that they will be acted on.

24-hour acknowledgment SLA

We respond to every abuse report within 24 hours of receipt. Confirmed phishing, malware, or fraudulent QR codes are disabled immediately upon verification — typically within minutes, not hours.

Our acknowledgment is the start of an investigation, not the end of the process. Reports that require deeper review (trademark disputes, content policy edge cases) may take longer to resolve, but you will always hear back within 24 hours.

Failed acknowledgment is the operational risk we take most seriously — we maintain Telegram alerts on every new report and a pre-SLA escalation at 18 hours to ensure no report goes unanswered.

How to report abuse

Three ways to report, in order of speed:

1. Public form: qrlynx.com/report-abuse — fastest path. Lands directly in our admin queue with a tracking ID.
2. Email: abuse@jorbox.com — routed to the same queue. Use this for evidence attachments or formal organizational correspondence.
3. Cloudflare abuse reporting: reports filed via Cloudflare\u0027s trust hub are forwarded to our designated abuse contact.

Each report should include the suspicious URL (we accept both r.qrlynx.com/... short links and destination URLs), a category, and a brief description of what you observed. Reporter contact information is optional but helps us follow up if we need additional details.

What we act on

We disable QR codes that:

• Phishing — credential theft, fake login pages, impersonation of trusted brands
• Malware — drive-by downloads, exploit kits, malicious payloads
• Spam — unsolicited mass-distribution, deceptive content
• Illegal content — CSAM (immediate suspension), other content that violates U.S. or destination-country law
• Trademark / IP violations — confirmed brand impersonation per DMCA-style process

We do not moderate political content, adult content posted between consenting adults, or content that is merely controversial. The standard is harm or deception, not viewpoint.

Layered defenses

Our defenses run at multiple layers so that no single component is the line of defense:

• Account layer — disposable-email blocking (6,058 domains), new-account quarantine, signup behavioral monitoring with Telegram alerts on suspicious patterns.
• URL intake — Google Web Risk API, lexical risk scoring, DNS-age and nameserver-reputation checks, smart-rule destination scanning, and free-host destination warnings at create time. Telegram alerts on every flagged URL.
• Continuous monitoring — daily re-scan of high-traffic QRs against Web Risk threat feeds, plus a 30-minute behavioral analysis cron that scores QRs on geographic distribution, share-link dominance, abuse-report counts, and other signals.
• Scan-time enforcement — security interstitial fires when verification has failed, abuse reports have accumulated, or behavioral signals indicate abuse. Auto-blocking on 3+ unique user reports.
• Abuse intake — unified queue for form submissions, email reports, Cloudflare-forwarded reports, and worker-side interstitial reports. Every report fires a Telegram alert in real time.
• Account remediation — atomic ban that disables all QRs, terminates sessions, and clears cache state in a single transaction. Reversible for false positives.

Recovery posture

If our redirect domain is ever flagged by a browser safe-browsing system in error, we have:

• Email notifications from Google Search Console and Bing Webmaster Tools the moment any flag is applied
• A documented recovery playbook covering each blocking authority\u0027s appeal process and SLA
• Direct lines to our hosting provider (Cloudflare) for escalation
• Cold-standby infrastructure prepared to maintain service for new QR creates during any appeal period

We expect to act on confirmed false-positive notifications within hours, not days.

Operating entity

QRLynx is operated by Jorbox LLC, a software company in business continuously since 2012, headquartered in Albuquerque, New Mexico, USA. Our security.txt file is published at /.well-known/security.txt.

For security disclosures and abuse reports: abuse@jorbox.com. For general support: support@qrlynx.com. Both contact addresses are monitored.