Retail runs on links. Order confirmations, dispatch notices, refund forms, password resets, seller listings, support replies — a customer receives dozens from you and cannot tell yours from a clone. Screening every URL you send, render or receive against a list of DNS-verified live phishing domains is the cheapest control in the entire stack.
Attackers impersonating a retailer are not inventing a story. They are reusing the exact sequence of messages your platform already sends, at the moment the customer is expecting them.
The shopper arrives at a storefront they have never visited, from a link somebody else chose to put in front of them.
An email address and a password handed to a site that has existed, from their point of view, for about ninety seconds.
Into a checkout page hosted on a domain that may not match the brand printed on the box that eventually arrives.
An order confirmation carrying a tracking link, which the shopper is now actively waiting for and will click without reading.
A dispatch notice from a carrier they did not choose, a delivery notification, and probably a review request.
Every step in that sequence is a link from a sender the customer only half-recognises, asking for information they have already been persuaded is normal to give. A phishing campaign that copies the sequence is therefore not asking its victim to do anything unusual at all — it is asking them to do exactly what they did yesterday, at the moment they are expecting to be asked.
None of these require the attacker to be clever, and all of them work better against your customers than against anybody else's, because your customers are the ones who have been trained to expect that message.
Each of these is a point where a URL crosses a boundary — into a customer's inbox, onto a page you render, or into a support agent's browser. Those crossings are where a check belongs.
The useful way to place this control is to stop thinking about "phishing protection" as a product category and start listing the moments when a hostname you did not personally write moves toward a customer. There are more of them than most teams expect, and each one is a single call away from being verified. The lookup returns is_phishing, category, dns_status, last_checked and a confidence value in well under fifty milliseconds, which is fast enough to sit inline in a send pipeline or a form submission without anybody noticing it is there.
Extract every hostname from the rendered template before it queues — tracking links, carrier redirects, marketing widgets, third-party review requests — and hold the send if one of them is on the list.
Short messages carry shortened links, which means the visible text tells the recipient nothing. Resolve, then check the destination host before the message leaves your gateway.
Every URL a seller supplies at signup — storefront, returns policy, support site, social profile — is checked before the account is approved, and re-checked on a schedule afterwards.
Product descriptions, seller storefront copy, buyer reviews and Q&A answers can all carry links. Screen them at submission so a phishing destination never renders under your domain.
Customers paste the link that worried them straight into a ticket. Checking it automatically gives the agent a verdict in the ticket view instead of a decision they are not equipped to make.
The daily feed loads the whole database into a resolver, firewall or SIEM, so egress from your own estate is blocked and historical logs can be searched against yesterday's list.
A retailer's transactional stream is large, templated, and assembled from pieces that other teams and vendors control. That is exactly the shape of thing that quietly goes wrong.
Nobody in a retail organisation writes the links in a dispatch email by hand. They come from a template that pulls a carrier tracking URL from a shipping integration, a returns portal link from a logistics vendor, a review-request link from a reputation platform, a product image from a content delivery network, and an unsubscribe link from the sending platform. Half of those are configured once, by someone who has since changed role, and never looked at again. When a vendor's domain lapses, when a redirect service is retired, or when a marketing campaign parameter is pasted in from the wrong document, the failure is silent — the mail sends, the link goes somewhere unintended, and you learn about it from a customer.
The fix is a single step in the send path: after a message is rendered and before it is queued, extract the hostnames it contains, deduplicate them, and check them. Because templates repeat, a cache keyed on the hostname with a lifetime measured in hours means a campaign sending two million messages costs a few hundred lookups rather than two million — the distinct-hostname count in a retail send is usually in the low tens.
# One hostname, inline in the send pipeline
curl "https://phishingdetectionapi.com/api/v1/check?domain=track.example-carrier.com&apikey=YOUR_KEY"
# All distinct hostnames from a rendered template, or a batch of seller URLs.
# Maximum 100 domains per request, one credit per domain.
curl -X POST https://phishingdetectionapi.com/api/v1/batch \
-H "Content-Type: application/json" \
-d '{"apikey":"YOUR_KEY","domains":["track.example-carrier.com","returns.example-3pl.com"]}'
# Response shape used by the send-hold rule
# {"domain":"..","is_phishing":true,"category":"..","dns_status":"..",
# "last_checked":"..","confidence":0.98,"database_size":390000}The reason this is usable inline, in a pipeline that cannot afford noise, is the admission standard for getting into the database at all.
A list assembled from everything anyone has ever reported becomes less useful every month it exists. Most of the entries describe hosts that stopped answering long ago, so a match tells you very little and a high proportion of your alerts concern something that is no longer happening. Wire that into a checkout flow or a send-hold rule and you will be turning it off within a fortnight, because the operational cost of investigating dead entries exceeds the value of the live ones.
Sellers, merchants, reviewers and customers all hand you hostnames. Every one of them will be displayed to somebody else on a page carrying your brand.
A new seller supplies a storefront address, a returns policy link, a support site, sometimes a social profile. Check each of them before the account is approved. A match is not automatically a reason to refuse the application — a small merchant's site can be compromised without their knowledge, and telling them so is a better outcome than a silent rejection — but it is unambiguously a reason to hold for review rather than approve into a queue nobody looks at again.
A URL that was clean at onboarding can point somewhere entirely different eighteen months later: the domain lapses and is re-registered, the site is compromised, or the seller swaps the destination once their account has accumulated ratings. A scheduled sweep of every stored merchant hostname through the batch endpoint turns a one-off gate into an ongoing control — fifty thousand seller URLs re-screened monthly is fifty thousand credits, which the $249 package covers twice over.
Product descriptions, storefront copy, buyer reviews, Q&A answers and seller messages can all carry links, and every one of them renders on a page carrying your brand above the fold. Screen server-side at submission so a phishing destination never reaches the page at all — in the write path, not in a nightly cleanup job, because the window between publication and cleanup is exactly when the content gets seen.
Customers routinely paste the suspicious link straight into a ticket or a chat, and "is this from you?" is one of the most common contact reasons a retailer has. Running an automatic check at ticket creation puts a dated verdict in front of the agent instead of asking them to make a security judgement between two other conversations. It shortens the reply and makes the answer consistent across a team of hundreds.
Those support matches quietly produce the most valuable dataset you have about campaigns aimed at your own customers. Aggregate a week of them and you know which of your brands is being impersonated and which lure is currently working — better early warning than anything you could buy, and it arrives as a by-product of answering tickets you were answering anyway. The helpdesk and support use case covers the ticket-side workflow in more detail, and multi-vendor operators will recognise the onboarding pattern from the online marketplaces use case, where the same check runs against far higher volumes.
The same lookup is doing progressively more work as the number of parties who can put a URL into your system grows.
It is worth being clear about which of these you are, because the answer determines where the check pays back first and how much volume you should budget for. A single-brand retailer is defending its own customers against imitation of one identity. A marketplace is defending buyers against thousands of independent sellers, some fraction of whom are compromised or hostile. A commerce platform is defending other companies' customers on infrastructure it operates but does not control the content of — the hardest position of the three, and the one where the daily feed usually beats per-lookup billing.
You control every link you send and every page you render, so outbound screening is close to complete coverage of what you can influence. The exposure is impersonation: clones of your storefront, fake dispatch mail carrying your logo, and gift-card lures using your brand.
Thousands of independent sellers supply URLs at onboarding, in listings, in storefront copy and in buyer messages. Any of those can point somewhere hostile, and everything renders on pages carrying your name rather than theirs.
You host storefronts for merchants who own their own domains, brands and customer relationships. Their customers are phished using their brands, and the complaints and the outage-shaped consequences still arrive at your support desk.
A control you can act on automatically has to be one you understand precisely. Here is what each answer means before you build a rule on it.
A match states that this exact hostname was verified as resolving in DNS and confirmed as hosting phishing content on a dated build, with a category and a confidence value attached. It is an observation, made independently of whoever reported the link to you.
A clean result means the hostname is not on today's list. It is not a safety rating, a reputation score, or a judgement about a page nobody has yet examined. Treating it as an endorsement is the single most common way teams misuse a known-bad list.
It is a floor, and a floor is worth having. Everything already confirmed as live phishing infrastructure becomes cheap to identify and consistent to act on across every team that touches a URL — marketing operations, seller onboarding, trust and safety, fraud, and the support desk. That consistency is most of the value: the same answer, from the same source, at every crossing point, instead of six teams each making a judgement call.
Seven questions that come up in nearly every evaluation, answered without the marketing layer.
A single lookup typically returns in under fifty milliseconds, which is comfortably inside the budget of a form submission or a template render. In practice the number of calls is far lower than the number of transactions, because the distinct hostname count in a retail send is small and a short-lived cache keyed on the hostname absorbs the repetition.
Count distinct hostnames rather than messages or page views, then add your seller-URL re-screening volume and your support-ticket rate. Most retailers find the real number is one or two orders of magnitude below their first guess, because caching collapses templated sends.
Only where the clone's hostname has already been observed resolving and confirmed as phishing, which is a meaningful fraction but not all of them. This is a known-bad list, not a discovery service that generates candidate look-alike names from your trademark.
Different integration points do different jobs, and it is worth being deliberate about which of them you are funding.
Assume it will happen, because compromised small-business sites are a large share of live phishing hosting. The right response is to hold the account for review and notify the merchant with the specific hostname and the date it was observed, not to terminate silently. You are frequently the first party to tell them they have been breached.
No. The API key is passed as a query parameter or in the POST body, so putting a call in browser code exposes it to anyone who opens the network tab, and your credit balance becomes somebody else's. Every integration described on this page is server-side.
When you want the whole list locally rather than an answer per question. The feed is the complete database as CSV on a separate subscription, with the added and removed changelog alongside it, and there are three typical triggers for moving to it.
Put a check in the send pipeline, on the seller onboarding form and in the support queue, and the confirmed phishing destinations stop reaching the people who trust your brand. Start with a monthly plan sized to your distinct-hostname volume, or take the whole database daily if you need it locally.
