A farm office, a co-operative and a grain buyer all run on links: settlement notices, subsidy deadlines, parts orders, telemetry logins. Checking each hostname against a database of phishing domains verified as currently resolving takes the already-known destinations off the table, on equipment nobody has time to manage.
Agriculture digitised faster than it hired. The gap between the sophistication of the tools and the support available to run them is where phishing lives.
A grain operation of a few thousand acres runs a stack that would not embarrass a mid-sized manufacturer: agronomy platforms holding field-level yield history, telematics accounts tied to machinery worth more than the buildings, a co-operative portal, a crop-insurance login, a bank with wire capability, and half a dozen dealer ordering systems. Every one of them authenticates with an email address and a password.
A lookup against a list of domains verified as currently resolving and confirmed hostile does not need an administrator, a console, an agent on every device, or anyone's ongoing attention. It answers one factual question about one hostname and returns in under fifty milliseconds, which on a rural link is imperceptible next to the page load it precedes.
One organisation holds the contact details, delivery records, account numbers and payment routing for every farm in a trading area. That is not an ordinary customer list.
Think about what a grain co-operative or a farm supply co-operative actually stores. Aggregate the following across a membership of several hundred farms and you have a document that describes the entire economic activity of a region, keyed to the people who own it and the accounts they get paid into.
A convincing message that appears to come from the co-operative, addressed to a named member, referencing a real delivery ticket number and asking them to confirm updated banking details for their next settlement, is not a generic scam — it is a personalised one built from stolen operational data, and it works on people who are not remotely careless.
Knowing that a specific farm delivered soybeans on a specific date to a specific elevator is exactly the detail that converts a suspicious email into a routine one. Attackers do not need to guess at the pretext when the operational record hands it to them. This is why a compromise at the co-operative propagates outward to members who never made any mistake of their own, and why the co-operative's own credential hygiene is a shared asset rather than an internal matter.
The awkward structural fact is that co-operatives are member-owned and typically lean. A general manager, a grain merchandiser, an office manager, a handful of location staff — and an IT arrangement that consists of whoever set up the accounting system originally. The organisation carries concentration risk on the scale of a small bank while operating with the technical staffing of a small retailer. Where the co-operative also runs a member portal with a login page, it inherits a second problem: a portal that members are trained to sign into is a portal worth cloning, and the members most likely to fall for the clone are the ones least equipped to notice.
Fake settlement notices quoting a plausible ticket reference, asking the member to confirm payment details before the transfer runs.
Seed, fertiliser and chemical invoices arrive in bulk at exactly two points in the year, which is when amended remittance instructions get paid without a second look.
A breakdown mid-harvest produces urgent parts orders through dealer portals, and urgency is the whole mechanism a cloned ordering login relies on.
Enrolment windows and compliance deadlines for farm-support programmes create a hard date, an official tone and an unfamiliar sign-in page.
A claim after a weather event is filed by someone already under stress, on a portal they use once every few seasons and cannot visually verify.
Brokerage and hedging platform logins are financial accounts wearing agricultural clothing, and they are targeted as financial accounts.
Screening addresses the mechanical part of this. Hostnames in outbound member communications should be verified before the message goes out, so the co-operative never becomes the delivery vehicle for a link that has already turned. Hostnames in inbound mail to the office should be checked before staff see them. And the domain variants that most obviously imitate the co-operative's own portal are worth submitting to the batch endpoint periodically, which gives a factual answer about whether any of them is currently live phishing infrastructure. Organisations extending this to their wider trading relationships will find the same logic on our supply chain and brand protection pages.
Payment-diversion fraud works best where transfers are large, infrequent and expected. Agriculture is close to the ideal case.
Most businesses pay and get paid continuously. A farm does not. Money leaves in two concentrated pushes — inputs before planting, then fuel, custom work and repairs through the season — and an input supplier's invoice with changed bank details, sent when a farm is paying five suppliers in the same fortnight, is unlikely to be the message anyone stops to question.
The harvest window is when the office has least capacity to think. Machinery is running, weather is deciding the schedule, and the person handling the paperwork is also handling everything else. That is not a training failure — it is an accurate description of the job in October. Any control that depends on someone pausing to reason carefully about an email is being asked to work at precisely the moment the conditions for careful reasoning do not exist.
Money arrives when the crop is sold or the livestock go, which means a single transfer can represent a meaningful fraction of an entire year's revenue, initiated by an office of one or two people who may execute only a few such transfers annually. Every ingredient that makes wire fraud profitable is present: high value, low frequency, no muscle memory for the process, and a legitimate expectation that the payment is imminent.
Attackers exploit the predictability rather than improvising. An amended-remittance message timed to the week a grain contract settles does not have to be clever, because it is arriving when the recipient is genuinely waiting for exactly that correspondence. Timing does the work that a sophisticated forgery would otherwise have to do.
Two controls follow from this, and they are different in kind. The first is procedural and has nothing to do with software: banking details are confirmed by telephone to a number held before the message arrived, and no exception is made for urgency. That defeats the amended-instruction attack outright, including the versions that contain no link at all and that no lookup service can see. The second is mechanical: hostnames in the surrounding correspondence are screened automatically, so the credential-theft campaigns that precede these attacks lose their already-known destinations. Neither substitutes for the other, and the second is the only one that keeps working when nobody has time for the first.
The value of a blocklist is not its size. It is whether the entries in it are still live and whether the file is current this morning.
The verification standard is the part worth understanding, because it changes what the number means. Roughly 390,000 domains are active in the database at any given moment, and that figure is deliberately not the total ever reported. An entry earns its place by resolving in DNS right now; when it stops, it leaves. For a farm running a small resolver on an already-modest connection, that distinction is operational rather than philosophical — a file bloated with years of dead entries is slower to load, slower to match against, and no more protective than the current one.
Phishing hostnames have short working lives, frequently measured in days, and a list refreshed monthly is mostly a historical document by the time it is deployed. Twenty-four-hour rebuilds with a published changelog let a co-operative or a farm office see exactly what entered the file overnight, which is also the cheapest way to convince a sceptical board member that the churn is real rather than a marketing claim.
Ranked by how much they return for the effort involved, not by how interesting they are to build.
If there is a router, firewall or small DNS server in the farm office, loading the daily CSV there protects every device that uses it — office machines, the shop computer, the tablet in the tractor cab, the phones on the yard Wi-Fi — without installing anything on any of them.
Extract hostnames from incoming messages and check them before a person reads the mail. This is where invoice fraud, subsidy-deadline lures and dealer-portal clones arrive, and it is the single highest-density source of hostile links in the business.
A co-operative sending market updates, settlement notices or programme reminders to several hundred members is a distribution channel. Verifying every hostname in the send before it goes out prevents the organisation from delivering a link that has quietly turned hostile since it was written.
Companies building farm management software, marketplaces or agronomy platforms can screen user-submitted links, listing URLs and profile fields on the server before they render to another user. The interface is one REST call, so it fits inside an existing validation step.
The office computer accumulates bookmarks to dealer portals, insurance sites, market data and government services over a decade. Domains lapse and get re-registered by somebody else, and nobody re-checks a link that has worked since 2016.
Grain dryer controllers, irrigation panels, scale-house terminals, security cameras and whatever a technician left connected after the last service call all sit on the same network as the office. None of them can run an agent and most cannot be patched on any schedule.
On-farm technology is bought as equipment, not as computers, which is exactly why it never appears on anyone's asset list.
A modern farm carries a population of connected devices that nobody in the business would describe as computers. The grain dryer has a controller with a web interface. The irrigation pivots report to a cloud account. The scale house runs a terminal that has not been restarted since it was commissioned. Guidance displays in the cab hold telematics credentials, and a technician's laptop connects to half of them during service visits. None of this was procured through anything resembling an IT process, none of it is inventoried, and a good deal of it authenticates to a vendor cloud with a password somebody wrote on a card in the shop.
There is no agent for a dryer controller and no patch schedule for a pivot panel, and even if there were, no one on the farm would be running it. The realistic control for unmanaged devices is the network layer, because it is the one place every device passes through regardless of what it is or who made it. Loading the daily feed into whatever resolves DNS for the yard network means a compromised display or a technician's infected laptop cannot reach a destination already known to be hostile, and it requires nothing from the device itself.
Where the link is fixed wireless or satellite, an outage is normal rather than exceptional, and a security control that stops working when the internet degrades is a control that stops working when the weather turns. Local matching against a downloaded file keeps enforcing during an outage; there is no verdict service to be unreachable at the worst possible moment.
For everything else, the interface is small. A single lookup is a GET against /api/v1/check carrying the hostname and your key, returning domain, is_phishing, category, dns_status, last_checked, confidence and database_size. Anything list-shaped goes to /api/v1/batch as a JSON body with up to a hundred domains, one credit per domain. Both are server-to-server calls: the key travels as a query parameter or in the POST body, and it must never appear in client-side code. Operations that also want the network layer should read the DNS filtering page alongside this one.
# Single lookup, server-side, one credit
curl "https://phishingdetectionapi.com/api/v1/check?domain=grain-settlement-portal.example&apikey=YOUR_KEY"
{
"domain": "grain-settlement-portal.example",
"is_phishing": true,
"category": "phishing",
"dns_status": "resolves",
"last_checked": "2026-07-27",
"confidence": 0.98,
"database_size": 390000
}
# Up to 100 hostnames from the office bookmark export, one lookup each
curl -X POST https://phishingdetectionapi.com/api/v1/batch \
-H "Content-Type: application/json" \
-d '{"apikey":"YOUR_KEY","domains":["dealer-parts-login.example","cropinsurance-claims.example"]}'Sizing is arithmetic rather than guesswork, and the delivery method follows from the shape of the operation rather than from its acreage. Read the row that describes you.
| Operation | What there is to screen | How it is delivered | Where the volume usually lands |
|---|---|---|---|
| Single farm office | Inbound mail, plus an annual sweep of saved bookmarks | One scripted API call inside existing mail automation | Perhaps a few thousand distinct hostnames a year — comfortably inside the Growth package of 10,000 credits at $0.0040 per lookup, and because lookups reset each month one purchase covers a full crop year |
| Grain or supply co-operative | Office mail plus every hostname in outbound member communications | API for mail, one batch call per newsletter send | Usually the $99 Growth package at 25,000 credits, or the $249 Professional package at 100,000 |
| Agtech platform | User-submitted links, listing URLs and profile fields before they render | Server-side REST call inside an existing validation step | Further up the table: the $499 Business package gives 250,000 credits at $0.0020 and the $999 Enterprise package gives 750,000 at $0.0013 |
| Yard and shop network | Every device that resolves DNS locally, agent or no agent | Daily CSV feed loaded into the resolver or firewall | No per-lookup credits consumed at all; the feed is a separate subscription |
A known-bad list is a floor. Selling it as anything more is how a farm ends up believing a problem is solved when it is only reduced.
Start with the definitional boundary. This database contains hostnames that have been observed and verified as live phishing infrastructure. A negative result means "not on the list", which is not the same as "safe". A domain registered this morning and used for the first time this afternoon against a dozen farms in one county will not be there yet. That gap is real and is shared by every blocklist that has ever been maintained. The correct conclusion is not that the list is weak but that it is one layer, and a page that told you otherwise would be selling rather than explaining.
An amended-remittance email arriving in a live thread, with correct names, a real contract reference and no link at all, contains nothing to look up. So does a telephone call claiming to be the grain buyer's accounts team. These are defeated by a callback rule to a number you held before the message arrived, by a second signature on payment-detail changes, and by an explicit understanding that urgency is never a reason to skip either. Those controls cost nothing and no software product replaces them.
If a telematics account or a co-operative portal login has already been entered somewhere it should not have been, the work is credential rotation across every system that shares that password, a review of recent payment-detail changes and orders, and notification to the parties whose data sits behind the account. Write that sequence down while the weather is bad and nothing is happening, because nobody drafts a procedure during harvest. The incident response page covers the shape of it.
Finally, a note about proportion. A blocklist deployed at the resolver and a callback rule written on a card by the office telephone will, between them, remove a large share of the realistic risk to a farm business for a cost that is trivial against the value of a single settlement transfer. That is a genuinely good trade, and it is also the whole of what is being claimed here. Anything beyond it — continuous monitoring, formal certification, a security programme — is a different conversation, and most farms do not need to have it before they have had this one.
Straight answers, including where the answer is that this is not the right tool for the job.
The lowest-effort version is one scripted check inside whatever automation your mail provider already supports, calling a single endpoint with a single parameter. That is an afternoon of work for anyone comfortable with a spreadsheet formula, and it covers the largest share of the risk on its own.
It is usually the point at which a co-operative or a local contractor holds it on behalf of several farms, in the same way shared agronomy or accounting services already work in most trading areas.
A single lookup typically returns in under fifty milliseconds, which is a small fraction of the time the page behind it will take on a rural connection. In practice nobody perceives it.
Not by itself, and it would be wrong to suggest otherwise. If the message contains no link there is nothing to check. What it does address is the credential theft that very often precedes it — the campaign that got into a supplier's mailbox in the first place.
Confirm any change of banking details by telephone to a number you held before the message arrived. Write it down, apply it without exception, and do not let a harvest deadline become the reason it was skipped.
You can cover your own systems and your own outbound communications, which protects members from anything that would have reached them through you. That is often the highest-value part of the deployment because it removes the co-operative as a distribution vehicle.
Nothing installs on them and nothing needs to. Devices like these cannot run an agent and are rarely patched, so the layer that reaches them is the network: whatever resolves DNS for the yard, loaded with the daily feed.
It covers the case where a device or a visiting technician's laptop tries to reach a known-hostile destination. It does not harden the device itself, and no honest description of it would claim to.
They have every property an attacker wants: an official tone that discourages questioning, hard enrolment and claim deadlines, real financial consequences for missing them, and a user base that signs in a handful of times a year and therefore cannot recognise a subtle deviation in the address.
The visual-recognition defence is essentially unavailable for portals used this infrequently, which is exactly why a check on the hostname is worth more here than on sites people visit daily.
A request contains one hostname and your key. No field names, no yield data, no member records, no message content and no identity of whoever was about to click. If a link points at a mainstream service, the hostname of that service is what is transmitted and nothing else.
Take the suspicious emails your office has already kept this year, pull the hostnames out, and check them by hand against the documented endpoint. That gives you a hit rate from your own mail rather than from anybody's brochure, and it is the number that decides the question internally.
Start with inbound mail to the office, measure the hit rate on messages you have already received, and add the resolver later if the numbers justify it. lookups reset each month, which is one full crop year from a single purchase.
