ShotkilnBot & abuse reports

Pages are rendered by a headless Chromium on Cloudflare Browser Rendering (Browser Run), identified by a user agent ending in ShotkilnBot/1.0 (+https://shotkiln.com/bot). Renders happen only when a customer requests a specific URL; we do not crawl.

We refuse private, loopback, link-local, carrier-grade NAT and cloud-metadata addresses on every request and redirect, non-http(s) schemes, and hosts on our denylist (static list + abuse.ch URLhaus feed, refreshed hourly).

To report abuse (for example a key used to render phishing pages), email support@shotkiln.com with the URL, time and any response headers such as X-Cache-Key.