A phishing link that resolves is a live path into the EHR, the imaging archive and the payroll file. The Phishing Detection API tells your mail gateway, your resolver and your help desk whether a domain is on a DNS-verified list of active phishing infrastructure, in under 50 milliseconds.
Almost every published account of a health-system encryption event begins with a credential or a click, not with an exotic exploit.
It carries a link to a page that reproduces the health system's single sign-on screen, down to the badge-tap prompt and the logo in the corner. The user authenticates, the credential and often the session cookie are captured, and a push notification is approved because it arrives seconds after a login the user believes they just performed.
It needs a registered domain, a hosting provider and, critically, an A record that resolves at the moment the victim clicks. Attackers register lookalike domains in bulk, stand them up for a short window, and abandon them once burned. That short life is exactly why a static blocklist assembled from historical reports ages badly, and why a list rebuilt daily and pruned of anything that has stopped resolving is a more honest description of the live threat surface.
From the captured credential the intruder reaches file shares, network drives and the departmental applications that hang off the EHR. Initial access is frequently sold on rather than used directly, which is why the gap between the click and the encryption event can be days or weeks.
Encrypted or precautionarily isolated systems mean the emergency department goes on diversion and ambulances are routed to other facilities, sometimes across a whole metropolitan area. Charting reverts to paper, radiology loses the worklist that routes studies from the modality to the reporting radiologist, and laboratory results that normally flow over an HL7 interface have to be phoned or hand-carried — delays measured in hours on pathways where minutes matter.
This is why a health-system CISO frames downtime as a patient-safety event rather than an IT event, and why the incident command structure that gets stood up looks more like a mass-casualty response than a service-desk escalation. Downtime procedures exist and clinical staff drill them, but they are designed for hours, not for the three to six weeks a full EHR restoration can take. Elective surgery is postponed, oncology infusion schedules slip, transfers from referring practices are declined — every one a clinical judgement made under degraded information, carrying its own risk profile that has nothing to do with whether the backups were good.
When health systems publish the cost of a ransomware event, the restoration work, the forensics engagement and the notification programme are rarely the largest lines. The dominant cost is lost clinical revenue during the disruption: cancelled procedures, diverted admissions, a coding and billing backlog that takes months to clear, and the accounts-receivable hole that opens while claims cannot be submitted. Add contract clinical staff brought in to run paper processes, and the ratio between what the attack cost to launch and what it cost to absorb becomes absurd.
Against that picture, checking a domain before a user reaches it costs a fraction of a cent, and the control acts at the only stage of the chain that is still cheap. Every later stage — privilege escalation, lateral movement, encryption, restoration, notification — costs more than the one before it, and none of them can be bought at a fraction of a cent.
None of this makes a domain-reputation check a complete answer. It is one control among several, and it is deliberately narrow: it answers whether a hostname appears on a DNS-verified list of active phishing and malware infrastructure, and it answers quickly enough to sit inline. What it does is remove a large, well-understood category of known-bad destinations from the population your mail gateway, your resolver and your help desk have to reason about, so that human attention concentrates on the genuinely novel. For the adjacent payer-side view of the same problem, see the insurance industry brief and the health insurance use case.
In a health-system context, the specific route by which an intruder first obtains an authenticated foothold: usually a harvested SSO or VPN credential, an approved MFA push, or a session token lifted from a lookalike login page. It is distinct from the later stages of privilege escalation and encryption, and it is the only stage where a domain-level check can act.
Electronic protected health information: individually identifiable health information that a covered entity or business associate creates, receives, maintains or transmits in electronic form. The HIPAA Security Rule requires administrative, physical and technical safeguards over ePHI, including a risk analysis and security-awareness measures for the workforce.
The lures that work against hospitals are specific to how hospitals are staffed, funded and connected to everyone else.
Healthcare organisations present an unusually wide attack surface for social engineering, and not because their staff are careless. A large health system employs tens of thousands of people across dozens of physical sites, with high turnover, rotating residents, agency and locum clinicians, and a permanent culture of urgency in which a message marked as time-critical gets acted on rather than questioned. Clinicians authenticate dozens of times a shift, often via badge tap at a shared workstation, which makes an extra credential prompt unremarkable. The organisation also transacts constantly with an enormous vendor and partner ecosystem, so an unfamiliar sender is not itself a signal.
The six patterns below are the ones that recur across provider organisations of every size, from a two-site physician group to an academic medical centre. Each one ends at a domain that has to resolve, which is the property the check exploits. The weighting meter on each card reflects how often the pattern turns up in provider incident reporting relative to the others, not a claim about severity.
A message that imitates the self-service HR portal asks a clinician to re-confirm banking details before the next pay run. The target is deliberately chosen: attending physicians and senior nursing staff have high salaries, irregular schedules and little time to verify. The link lands on a page at a domain like hr-selfservice-update.example.com that harvests both the SSO credential and the new account details.
The highest-value pattern. A near-perfect copy of the health system's federated sign-on page, reached from a message about a mandatory competency module or an expiring password. Because clinical staff reach the EHR through the same identity provider, one captured session yields access to the record, secure messaging and the departmental systems behind it. Reverse-proxy kits make the fake page relay a genuine MFA challenge.
Supply chain and accounts payable receive a change-of-remittance notice that appears to come from a distributor of consumables, a device manufacturer or a managed imaging service. The domain differs from the genuine one by a hyphen, a swapped character or a different top-level domain. Payments for high-value capital equipment and implantable devices make this pattern lucrative on a single success.
Here the victim is not an employee. Patients receive a message about a new test result, an outstanding balance or an appointment confirmation, pointing at a copy of the portal login. The health system carries the reputational damage and often the notification burden, yet has no endpoint control over the patient's device. Detecting the lookalike domain early gives the privacy officer and communications team something concrete to act on.
Academic medical centres run a second organisation inside the first: principal investigators, research coordinators, an IRB and a grants office, all handling funding correspondence with external bodies. Lures reference award notices, ethics submissions, manuscript reviews or trial-sponsor portals. The targets hold both institutional credentials and access to research data sets that may contain identifiable participant information.
Referring practices, the regional health information exchange and transcription or coding vendors exchange documents with the health system every day. A domain one character away from a genuine partner is used to intercept referral traffic or to plant a credential prompt in a workflow that staff already trust. Because the relationship is bilateral, a compromise at either end propagates to the other.
A domain check is only worth deploying if someone's day gets measurably easier, and three roles feel it first.
The first change is at the service desk. Health-system help desks carry a steady volume of "is this link safe" tickets, and they arrive from exactly the people you least want to keep waiting: a consultant between clinics, a ward manager mid-handover, a scheduler with a queue behind them. Today the analyst copies the URL, looks it up manually, checks a couple of free reputation sites that disagree with each other, and either makes a judgement call or escalates. The turnaround is measured in tens of minutes, and the user has usually made their own decision by then. A single API call against the domain returns a definite answer in well under a second, with a timestamp showing when the domain was last verified as resolving.
The second change is on clinical workstations. A modern ward is full of browsers that nobody thinks of as browsers: the VDI thin client at the nurses' station, the embedded browser inside a workstation-on-wheels, the vendor web console that drives a PACS viewer or an infusion pump management server. Many of these cannot take an endpoint agent, either because the vendor's support agreement forbids modification or because the operating system underneath is too old to run one. What they can all be made to do is resolve DNS through a controlled path, which means the domain check can be applied where an agent cannot go.
The third change is on the guest and patient network. Every hospital runs an open or lightly authenticated Wi-Fi network for patients and visitors, and it is legally and practically distinct from the clinical network. You are not going to inspect that traffic, and you should not try. Applying a known-bad domain list at the resolver for that network is a proportionate control: it does not touch content, it does not identify individuals, and it stops the most obvious harm on a network you offer as a courtesy but still own.
The "is this link safe" ticket stops being a research task. The domain is checked automatically as the ticket is created, and the response includes the verdict, the category and the last-checked timestamp. The help-desk lead gets a consistent answer instead of an analyst's judgement, and the clinician gets it while it still matters.
Thin clients, workstations on wheels and vendor consoles that cannot host an agent still resolve names. Enforcing the list at the resolver covers the embedded browser on a modality console and the management interface of a biomedical device without touching a validated configuration or voiding a support agreement.
A segregated network you own but do not manage endpoints on. A resolver-level block on known active phishing infrastructure is a defensible, privacy-light control that reduces harm to patients and visitors without content inspection or per-user attribution.
The load that disappears is the repetitive part of the job. Nobody maintains a hand-curated blocklist spreadsheet any more, or spends Monday morning reconciling three free reputation services that returned three different answers about the same host. Nobody manually pivots on every reported URL in the phishing mailbox to work out whether the destination is still live. Nobody writes the ad-hoc firewall rule at four in the afternoon because a domain turned up in proxy logs and no one is sure. The daily rebuild and the pruning of domains that have stopped resolving do that work on a schedule, and the analyst time it frees goes to the cases that actually need a person: the targeted lure at a named executive, the vendor account that started behaving oddly, the incident-response tabletop that keeps getting postponed. See the incident response and DNS filtering use cases for how the same feed is consumed by each function.
Four stages, each independently useful, and none of them requiring a change window on a clinical system.
Extract hostnames from inbound links and check them against the API in monitor mode. Compare the verdicts with what your gateway already blocked before you enforce anything.
Pull the daily CSV and load it into the recursive resolvers as a response policy zone. This is the step that reaches clinical devices and guest Wi-Fi, where no agent can run.
Enrich every reported-phish ticket automatically. The analyst opens a ticket that already carries the verdict, the category and the last-checked timestamp.
Batch-check the domains in patient-portal notifications and appointment reminders, so your own messages never carry a link to infrastructure that has been taken over.
No product delivers compliance, but some controls are far easier to evidence than others.
The HIPAA Security Rule is deliberately framed around safeguards rather than products. It requires covered entities and their business associates to implement administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of electronic protected health information. Two of its administrative requirements matter most here: a risk analysis that identifies threats and vulnerabilities to ePHI, and security-awareness measures for the workforce, which the rule describes as including protection from malicious software and procedures for monitoring log-in attempts. Phishing is precisely the threat those provisions were drafted around, even though the word does not appear in the rule text.
The practical consequence for a privacy officer or compliance officer is evidentiary. When a regulator or an auditor asks how the organisation addresses the risk identified in its own risk analysis, the strongest answer describes a mechanism with a schedule and an audit trail, not an intention. A domain-reputation check that runs on every inbound link, draws on a source rebuilt every twenty-four hours, and logs each verdict with a timestamp produces exactly that kind of record. It does not satisfy the requirement on its own, and nobody should claim it does, but it converts one line of the risk register from a policy statement into an operating control.
The Breach Notification Rule works on a different axis. It requires notification of affected individuals and of the Department of Health and Human Services following a breach of unsecured protected health information, with media notification for larger events. What determines whether a phishing incident becomes a notifiable breach is usually how far the intruder got and what they touched, which is a function of how quickly the initial access was detected. The value of a control that acts at the domain, before the credential is typed, is that it removes a class of incident from the notification pipeline entirely. Any log that shows a block occurred also feeds the risk assessment that determines whether an incident meets the notification threshold.
HITECH-era amendments changed the enforcement posture rather than the safeguards themselves. The most relevant change for a security programme is the direction that HHS take into account whether a regulated entity has had recognised security practices in place over the preceding twelve months when it considers enforcement outcomes and audits. That places a premium on continuity and documentation: a control that has demonstrably been running for a year, with a dated log of its verdicts, is worth more in that conversation than one deployed the week after an incident. Alongside it sits the voluntary practice guidance developed under section 405(d) of the Cybersecurity Act of 2015, which is written specifically for health-sector organisations and names email phishing attacks as one of the small set of threats every provider should have practices against, scaled to organisation size.
Providers operating in the European Union carry a second layer. The GDPR requires security appropriate to the risk under Article 32, and Articles 33 and 34 govern notification of a personal data breach, with seventy-two hours to the supervisory authority. Health data is a special category, so the risk calculation runs high by default. NIS2 names health as one of the sectors within scope and raises both cybersecurity and incident-reporting obligations across those sectors, with explicit accountability at management level. Neither instrument prescribes a specific technology, but both push in the same direction: demonstrable, maintained, documented controls over the routes an attacker actually uses. The table below sets out what each expectation asks for, where a DNS-verified domain check contributes, and where you plainly need something else.
| Framework or rule | Expectation | How a DNS-verified domain check helps | Where you still need other controls |
|---|---|---|---|
| HIPAA Security Rule safeguards | Administrative, physical and technical safeguards over ePHI, including a risk analysis and security-awareness measures such as protection from malicious software. | Gives the risk analysis a named, dated technical control against the phishing threat, with a per-verdict log covering mail, resolver and help-desk paths. | Access control, audit logging, encryption, contingency planning, workforce training, business associate agreements and the risk analysis process itself. |
| Breach Notification Rule | Notification of affected individuals and of HHS following a breach of unsecured protected health information, with media notification for larger events. | Prevents a category of initial access outright, and supplies timestamped block evidence that feeds the risk assessment behind a notification decision. | Forensics and scope determination, the notification workflow itself, legal review, and the substitute-notice and media processes. |
| HITECH-era enforcement posture | HHS is directed to consider whether recognised security practices have been in place for the preceding twelve months when weighing enforcement outcomes and audits. | A control that runs continuously and logs daily produces the twelve-month operating history that argument depends on. | The wider programme: documented policies, governance, board reporting and evidence that practices were adopted organisation-wide. |
| NIST CSF and 405(d) practice guidance | Voluntary, health-sector-specific practices that name email phishing among the core threats, scaled to small, medium and large organisations. | Maps directly to the detect and protect functions for the email and web access paths, and is straightforward to size for a clinic or a multi-hospital system alike. | Asset inventory, medical device security, identity management, vulnerability management and incident response planning. |
| GDPR and NIS2 for EU providers | Security appropriate to the risk under Article 32, breach notification under Articles 33 and 34 with 72 hours to the supervisory authority, and NIS2 obligations with management accountability for the health sector. | Documented, maintained and dated evidence of a technical measure protecting special-category data at one of its most exploited entry points. | Lawful basis, data mapping, DPIAs, processor contracts, supervisory authority reporting workflows and the wider NIS2 governance regime. |
The database is rebuilt on a twenty-four hour cycle and the feed is exported at 04:30 UTC. Ingested domains are resolved through rotating proxies using 50 concurrent threads with a 10 second timeout, and only those returning an active A record are retained. Anything that stops resolving is pruned on the next pass. That is what separates a live picture of phishing infrastructure from an archive of things that were once bad, and it is why a hit carries a last-checked timestamp you can put in front of an auditor.
Below, a health-system help desk checks a lookalike patient-portal domain reported by a patient. Full parameters are documented on the API reference, and the daily export is described on the daily feed page.
# Reported by a patient: a portal lookalike sent by SMS curl -s "https://phishingdetectionapi.com/api/v1/check\ ?domain=patient-portal-verify.example.com\ &apikey=YOUR_API_KEY" # Response { "domain": "patient-portal-verify.example.com", "is_phishing": true, "category": "phishing/malware", "dns_status": "resolves", "last_checked": "2026-07-27T04:30:11Z", "confidence": 0.98, "database_size": 212370 }
Four places the check earns its keep, and one constraint that shapes every healthcare deployment.
Start at the mail gateway, because that is where the volume is. Whatever platform sits in front of the mailboxes, the hook is the same: extract the registrable hostname from each link in an inbound message, deduplicate within the message, and check the set. Deduplication matters more than it sounds, because clinical newsletters and vendor bulletins repeat the same tracking host dozens of times in one email. The batch endpoint accepts up to 100 domains per POST and charges one credit per domain checked rather than one per request, so batching is about round trips and latency, not about cost. A gateway processing a few hundred thousand inbound messages a day settles into a predictable credit run rate once deduplication and a short local cache are in place, and the credit packs are sized in tiers from 10,000 up to 5,000,000 lookups with credits valid for twelve months.
The resolver path is the one that reaches the parts of a hospital nothing else reaches. Pull the CSV export with the feed endpoint, which returns three columns of domain, category and DNS status, and load it into your recursive resolvers as a response policy zone. Schedule the pull after the 04:30 UTC export so you are always working from the current build, and diff against the previous file so you can see what was added and what was pruned rather than reloading blind. Because the enforcement happens at name resolution, it covers VDI thin clients, workstations on wheels, vendor consoles and the guest network in a single change, and it does so without installing anything on a device whose configuration is validated. Note that the feed endpoint requires the daily feed subscription, which starts at $499 per month, whereas the check and batch endpoints run on ordinary credits.
Ticket enrichment and log correlation are the two integrations that make the security team's analytics better rather than just blocking more. On the service-desk side, add a step to the reported-phish workflow that calls the single check endpoint for each extracted domain and writes the verdict, category, DNS status and last-checked timestamp into the ticket before a human opens it. On the SIEM side, correlate the feed against proxy and DNS query logs on a scheduled basis. That retrospective sweep answers a question the inline control cannot: whether anyone in the organisation reached a domain in the window before it was ingested. If a workstation in the billing office queried a domain that appears in the current build, you have a starting point for an investigation with the device, the timestamp and the user already identified. The DNS filtering and healthcare use-case pages walk through both wiring patterns in more detail.
The constraint that shapes every healthcare deployment is the clinical network itself. A large share of the devices on it cannot take an agent, cannot be patched on your schedule and in some cases cannot be rebooted outside a planned window: infusion pump servers, imaging modality consoles, laboratory analysers, anaesthesia machines and the interface engines that carry HL7 and FHIR traffic between them. Biomedical engineering, not IT, owns many of them, and the vendor's support agreement may prohibit any modification to the host. Any control that depends on installing software on those endpoints is, in practice, a control you will not deploy. A check that operates on domains, applied at the mail gateway and at the resolver, sidesteps that problem entirely: it changes nothing on the device and needs no agreement from the device vendor, while still covering the traffic those devices generate. Keys are passed as the apikey parameter and must stay server-side, in the gateway, the resolver management host or the SIEM connector, never in anything that runs on a clinical workstation.
Adjacent sectors that share a threat model with provider organisations, and the pages that explain the mechanics.
Clinical trial correspondence, manufacturing supply chains and research data attract the same lure patterns as an academic medical centre, with different data at stake.
Read the use caseIf you run an academic medical centre, you already carry a university's threat profile alongside a hospital's: research funding lures, federated identity and a large transient population.
Read the industry briefPublic health agencies, national health services and state-run hospital networks operate under both healthcare and public-sector obligations. The overlap is covered here.
Read the industry briefRegister for an API key and run your first lookups against the mail path today. Pay-as-you-go credits start at $59 for 10,000 lookups and stay valid for twelve months, and the daily CSV feed is available separately for resolver and SIEM ingestion.
