Players do not get phished by email. They get phished by a friend whose account was stolen last night, by a giveaway that expires in nine minutes, by a trading site that looks exactly like the one they used yesterday. Screening every hostname a player can be shown — in chat, in a profile, in a party invite, on a marketplace listing — against a DNS-verified list of live phishing domains is a server-side call that costs a fraction of a cent.
Two properties make it worth stealing, and the second one is what turns a single theft into a campaign.
Start with what is inside. A long-running account on a major platform is holding five separate things worth money.
None of that requires the attacker to understand your game. They need the password, or the session, and a place to move the goods. That is the entire business model, and it is why an account with a decade of history is worth more to a thief than a credit card number: the card gets cancelled in a day, and a rare inventory has no chargeback.
This is the one publishers underestimate. The moment an account is taken, it can post in every server, guild and party the real owner belongs to, message a friends list that has no reason to be suspicious, and reply in threads where the owner is a known regular. The link that arrives from a stolen account converts at a rate a cold email never will, because the social proof is real. The person really is your friend. The account really is theirs. Only the hands on the keyboard have changed.
One account falls to a look-alike sign-in page. Its friends list receives a message. A percentage of those click, land on the same page, and lose their accounts, which then message their own friends. The domain in the middle of that chain is the one durable artefact: it has to resolve, it has to serve the fake page, and it has to stay up long enough to collect. Everything else about the campaign — the wording, the emoji, the urgency, which game it claims to be about — changes weekly. The hostname is the part you can act on mechanically.
Each one ends at a hostname the player has to reach. That is the common denominator, and the place to intervene.
A pixel-accurate copy of the platform sign-in flow, on a hostname one character away from the real one, complete with a working password-visibility toggle and a second screen that asks for the one-time code. The second screen is the giveaway that this is a live relay, not a static capture.
Account takeoverThe oldest lure in the category and still the most productive against younger players. Enter your username, pick an amount, complete a “human verification” step, then sign in to claim. There is no generator. There never was. The sign-in step is the entire product.
Under-18 exposureTimed to a real event on your calendar, worded to match your own announcements, and given a countdown so nobody stops to read the address bar. The stronger versions mirror your actual event artwork, pulled straight from your press kit.
Launch windowsImpersonating third-party trading platforms rather than you, which is why they are so often missed: the player is not on your site, is expecting to sign in with a platform account, and has done exactly this a dozen times before. The clone asks for the sign-in and then drains the inventory.
Secondary marketTwo directions at once. Viewers get a fake channel giveaway or a cloned creator storefront; creators get a fake sponsorship brief with a “media kit” behind a sign-in wall. The second one is targeted, well-written, and arrives on the day a real deal would.
Creator economy“Your account has been reported for cheating — appeal within 24 hours or it is permanent.” Fear works faster than greed, and this one reaches the players who are most careful about giveaways. Refund and chargeback pretexts work the same way on the paying end.
Support queuesLook at those six together and the operational conclusion is not “train players to spot them”. Three of the six are indistinguishable from legitimate messages by design, one arrives from a genuinely trusted friend, and one exploits fear of losing an account rather than desire to gain something. Awareness helps at the margins and it is worth doing, but no amount of it produces a player who checks the certificate chain on a phone at eleven at night when a friend has just sent them a drop link.
What all six share is a hostname that has to be live. The kit has to be hosted, the domain has to resolve, and it has to keep resolving for as long as the campaign runs. A list built specifically on the requirement that every entry currently resolves in DNS is aimed at exactly that window: not an archive of everything ever reported, but a picture of what is reachable right now, rebuilt every twenty-four hours so entries that go dark drop out instead of accumulating.
Both, or the gap between them becomes the campaign's window.
Post time is the obvious one. A player pastes a URL into a lobby, a clan description, a support ticket or a marketplace listing; before that content is stored and rendered to anyone else, the backend extracts the hostnames and checks them. A confirmed phishing domain gets the message rejected, silently dropped, or held for a moderator, depending on how aggressive you want to be and how much you trust your own false-positive tolerance. The check is a server-side call and the player never sees it happen. Latency at this point is essentially free: a message is already crossing a network boundary and being written to a store, and a lookup under fifty milliseconds disappears into that path.
It is also the one that catches the campaign you did not see coming, because content is not static. A profile description written six weeks ago is rendered thousands of times afterwards. A pinned message in a community server stays pinned. A marketplace listing with a link to an external gallery lives until it sells. The hostname in that content was clean when it was posted — possibly because it had not been weaponised yet, possibly because the domain changed hands, possibly because it was registered specifically to sit dormant and pass exactly the check you ran. Re-checking on click, or on render for high-traffic surfaces, closes that gap. If you route outbound links through your own redirector, this is a single lookup at the moment of the redirect, and it is the highest-value check in the whole design.
| Property | Post-time check | Click-time check |
|---|---|---|
| Where it runs | In the message or listing service, before the content is stored and rendered to anyone else | In the redirector or the render path, at the moment the player actually follows the link |
| What it catches | The fresh blast — a takeover posting one new domain across every server at once | The sleeper — a pinned message or profile link that was clean the day it was written |
| Cache hit rate | Lower. It is dominated by hostnames you have never seen, because that is what a novel campaign looks like | High. Your own domains, the big video platforms and the wiki everybody links dominate the traffic |
| What drives credit spend | The rate of genuinely new links, not the message volume | The tail only — a modest time-to-live absorbs the overwhelming majority |
| Latency budget | Essentially free: the message is already crossing a network boundary and being written to a store | Synchronous, so it sits in the player's click. Under fifty milliseconds is comfortable |
| Player visibility | None. The check happens server-side and the player never sees it | An interstitial, which is what turns a block into a report you can act on |
Cache the verdicts, not the raw responses, and keep the time-to-live short enough that a domain flagged this morning stops being served from a stale allow decision this afternoon. Where you then draw the line between block, warn and log is a product decision rather than a security one, and it should be made by someone who owns the player experience.
A hard block on a confirmed phishing domain is defensible everywhere and almost never controversial. This is the default for chat, invites and anything a takeover can reach.
An interstitial that names the risk and requires a deliberate second click is the right treatment when the link sits on a surface where legitimate external links are normal.
Silent logging with no player-facing effect is the correct starting configuration for the first two weeks. It tells you your real hit rate on your real traffic before you change anything anyone can see.
One more thing belongs at post time: the report path. Whatever you build, give players a one-tap way to flag a link, and route those reports somewhere a human reads. A verified list catches what has already been observed; your own players are the sensor that catches what has not. The pattern is the same one described on our messaging apps page, where user reports and automated screening feed the same queue.
The thing that makes gaming different: in most industries the phishing message comes from a stranger and the defence is teaching people to distrust strangers. Here it comes from a friend whose account was taken an hour ago, into a channel built entirely on trust between players — so the only intervention that scales is one that acts on the destination rather than on the sender.
The same list, wired into whichever surface you actually control.
Every text channel in the game is yours: lobby chat, party invites, clan descriptions, in-game mail, name fields that people abuse as link carriers. Screening happens in the message service before delivery, and the player sees nothing.
Storefronts, item marketplaces and trading services carry outbound links in listings, seller profiles and dispute threads — and they carry the sign-in that everyone is trying to clone. Screening protects both directions at once.
Community servers, guild sites, tournament platforms and creator dashboards see the highest link volume per user of anything in the ecosystem, and the least moderation capacity per message. This is where automation earns the most.
The split matters because the three groups have entirely different constraints. A studio can put a check in the message service and never surface it to anyone. A marketplace has to think about seller experience and cannot afford to reject a legitimate listing at three in the morning with no appeal path. A community tool has thousands of independent operators with different tolerances, which usually means the verdict has to be exposed as configuration rather than baked in as policy.
The naive number is frightening and wrong. The number after deduplication and caching is not.
Run the naive calculation first, because everyone does. Ten million messages a day, five per cent containing a link, is five hundred thousand lookups — and at that point somebody closes the tab. But that is not the workload. You are not checking messages; you are checking distinct hostnames. Strip everything that is not a link, reduce each URL to its registrable hostname, drop your own domains and the handful of platforms that account for most legitimate links, and deduplicate what remains inside a short window. The five hundred thousand collapses to a few thousand distinct hostnames a day, most of which you have already seen this week.
A verdict cache keyed on hostname with a time-to-live measured in hours absorbs the repeat traffic, and the credits go only to genuinely novel hostnames — which is precisely the population you care about, since a domain nobody in your ecosystem has ever linked before is the one most likely to be part of a fresh campaign. Batch the misses rather than calling one at a time: POST /api/v1/batch takes up to a hundred domains per request and charges one credit per domain, so a hundred novel hostnames from the last minute is one round trip instead of a hundred.
A mid-sized live game running post-time and click-time screening with a sensible cache typically lands in Professional at $249/month for 100,000 lookups, or $0.0025 per lookup. A large platform screening a marketplace and a community layer as well sits in Enterprise at Enterprise at $999/month for 750,000 lookups, at $0.0013. The largest tiers exist for exactly this shape of workload: Enterprise at $999/month for 750,000 lookups works out at $0.0010 per lookup, and Enterprise at $999/month for 750,000 lookups brings it to $0.0008. Credits are paid by PayPal, billed monthly, and there is no subscription or per-seat licence on the API itself — which matters when your traffic triples for the two weeks around a launch and then settles again.
The daily feed delivers the whole database as CSV plus a changelog of what was added and removed, on a separate subscription, and that suits a service that would rather hold the list in memory and match locally than call out per hostname. It is the right answer for an edge layer or a resolver; it is the wrong answer for a moderation pipeline that wants a fresh verdict and a confidence value per link. Most gaming deployments use the API and let the cache do the work.
The panel beside this is what a single compromised account looks like from your side of the moderation queue. It is not a hypothetical shape; it is the reason link screening pays for itself on the surfaces where players talk to each other rather than on the ones where you talk to players. Notice where the leverage is: by the time reports arrive you are cleaning up, and by the time you have identified the domain the campaign has moved to the next one. The only step in that sequence where a machine beats a human is the first one — the moment the message is posted and the hostname is available to check, before anyone has clicked anything.
The same reasoning applies to the creator economy sitting alongside your game. A creator with a large audience is a single point of failure: their channel description, their pinned links, their storefront and their sponsorship inbox all reach thousands of players who trust them by default. Screening the links they publish, and the briefs they receive, protects a chunk of your player base through one account rather than millions of individual checks. The cross-platform version of this problem is covered on our social media page.
A post-time lookup ends this at 00:04, before a single friend sees the link.
Two endpoints, one rule about the key, and a cache in front of both.
The single-domain call is GET /api/v1/check?domain=<host>&apikey=<key>. It returns the domain, an is_phishing boolean, a category, the dns_status, a last_checked timestamp, a confidence value and the current database_size. That is the call a redirector makes at click time, and it is the one to reach for when a moderator wants a verdict on a single hostname while looking at a report.
POST /api/v1/batch with a JSON body of {"apikey":"..","domains":[..]}, capped at a hundred domains per request and charged one credit per domain. That is what the message pipeline uses: accumulate the cache misses from a short window, send them in one request, write the verdicts back into the cache, and apply the policy. Both endpoints are server-side calls. The key travels in the query string or the POST body, so it belongs in your backend environment and nowhere near a game client, a browser bundle or a bot's public configuration file.
# One hostname, at click time, from your redirector
curl -s "https://phishingdetectionapi.com/api/v1/check\
?domain=steamcommunlty-trade.example&apikey=$PDA_KEY"
# {"domain":"steamcommunlty-trade.example","is_phishing":true,
# "category":"phishing","dns_status":"active",
# "last_checked":"2026-07-27T04:31:00Z","confidence":"high",
# "database_size":392418}
# Up to 100 novel hostnames from the last message window, one call
curl -s -X POST https://phishingdetectionapi.com/api/v1/batch \
-H 'Content-Type: application/json' \
-d '{
"apikey": "'"$PDA_KEY"'",
"domains": [
"free-vbux-generator.example",
"discordgift-nitro.example",
"cs-skins-market.example"
]
}'Three places where the standard advice — be careful what you click — is least likely to work.
Take the age question honestly. A large share of the audience for the most-played titles is under eighteen, and in the games where that share is highest the dominant lure is free currency. Follow one of those giveaways all the way through and you can see why awareness training is not the control that stops it.
It costs nothing, it promises something the player wants and cannot buy, and it is wrapped in the vocabulary of an economy where codes, drops and giveaways are genuinely normal. It arrives in a server the player already trusts, often from an account they already know.
A twelve-year-old typing a username into a generator site is not being reckless by the standards of their own experience. They are doing what the last five legitimate promotions asked them to do, and a username is not a secret.
The countdown, the progress bar and the “human verification” gate exist to make the page feel like a real system doing real work. Friction reads as legitimacy to somebody who has never seen a fake one.
Credentials go straight to a relay, and if the account has a one-time code it is requested on the next screen and replayed against the real platform within seconds. Nothing is ever generated, because there was never a generator.
Tradeable items are transferred out and re-listed, the currency balance is spent, and the saved payment method is used for whatever converts fastest. The friends list gets the same link a few minutes later.
The payment method on the account often belongs to a parent, and the recovery email is frequently one the child does not control. The first anyone hears about it is a chargeback, an angry support ticket from an adult who has never played the game, or a public post about your platform being unsafe.
Screening the links before they reach the player is the only control in that chain that does not depend on a child making an adult judgement under time pressure — and it pairs naturally with whatever household-level controls the family has already set up, discussed on our parental controls page.
Fear-based lures deserve separate attention because they catch a different player. The ban-appeal message — your account has been reported, appeal within twenty-four hours or the ban is permanent — works on the careful players. Someone who would never touch a free-skins site will absolutely click a link that threatens an account they have spent years and real money on. The refund and chargeback variants work the same way on paying customers, and both classes of message have a detail that makes them mechanically detectable: they have to send the player to a hostname that is not yours, because the whole point is to capture a sign-in outside your control.
Your own support and appeals queue. Players forward the message they received, paste the link, and ask whether it is real. Every one of those is a free sample of an active campaign, arriving with a timestamp and a player ID attached. If your ticketing system extracts the hostnames and checks them automatically, the agent gets a verified answer before they reply, your intel improves without anyone running an investigation, and the player gets a correct answer instead of a hedge. It is the cheapest intelligence source you own, and most publishers throw it away.
Better stated by you in the design review than discovered by someone else in an incident.
The answers that decide whether this lands in the next sprint or the next roadmap.
Typical lookup latency is under fifty milliseconds, and the vast majority of messages never trigger one because they contain no link at all. Of the ones that do, a verdict cache serves most of them without leaving your infrastructure. The lookups that actually go out are the novel hostnames, which is a small fraction of a small fraction.
If your delivery path is genuinely latency-critical, run the check asynchronously: deliver optimistically, check in parallel, and retract the message on a confirmed match. Players see a message vanish a moment after it appears, which is a far better outcome than a chat system that stutters on every link.
Four levers, applied in this order, keep the spend flat while the traffic is not — because together they reduce it to novel hostnames only, and novel hostnames are the ones worth paying for.
lookups reset monthly and there is no subscription, so buying ahead of a launch window and drawing it down over the following quarters is a normal pattern. If you want a fixed ceiling, cap the lookups per minute in your own proxy and let the excess fall back to the cache with a longer time-to-live.
Yes, and it is one of the highest-value places to put it, because community servers carry enormous link volume with very little moderation capacity. The bot extracts hostnames from messages, checks them, and deletes or flags on a confirmed match while logging the verdict for the moderation team.
The one hard rule is where the key lives. If your bot is self-hosted by hundreds of independent server owners, the key cannot ship in the configuration — it will be extracted almost immediately. Run the lookups through a service you operate, authenticate each installation to that service, and apply your own per-server rate limits.
Keep a local allow list that is consulted before the API call, and put a hostname in it the moment you have verified it yourself. The check returns a confidence value alongside the verdict, so you can also choose to warn rather than block below a threshold you set, which gives you a softer failure mode on the surfaces where a false positive would be most annoying.
Review that allow list on a schedule. Domains change hands, and an exception added eighteen months ago for a legitimate community site is exactly the kind of entry that becomes a hole. A quarterly re-check of every allow-listed hostname costs one lookup each and takes a scripted minute.
Partly, and it is worth being precise about how. Generate the plausible look-alikes of your platform, launcher and storefront domains — character swaps, hyphen insertions, alternative top-level domains, common misspellings — and run them through the batch endpoint on a schedule. What comes back is a verified answer on which of them are live phishing infrastructure right now, which is exactly the evidence a takedown request needs.
What it is not is a monitoring service that watches registrations as they happen. It answers the question “is this specific hostname confirmed hostile today”, which is the question that matters when you are deciding whether to warn players and file with a registrar.
Invisible at post time, visible at click time. Silently dropping a confirmed phishing link from chat needs no explanation and gives the attacker no feedback about what you detect. An interstitial at click time, on the other hand, is worth showing: it tells the player something specific happened, which is how the report reaches you. Write it like a person, and give it three things to say.
A page that says only “blocked” produces a support ticket. A page that says what happened produces a report you can act on.
Because they answer different questions and disagree usefully. A general reputation service classifies broadly and covers many categories; this database does one thing, which is confirming that a specific hostname is live credential-harvesting infrastructure, with a DNS-verification requirement that keeps dead entries out. Overlap between the two is partial by nature, and the part that does not overlap is the part worth paying for.
Running both is normal and cheap, since the second lookup only happens for hostnames the first one cleared. If the two disagree on a hostname that is about to be shown to a million players, that disagreement is itself a signal worth routing to a human.
Two endpoints, a cache, and a verdict on every hostname your systems are about to show someone. lookups reset monthly with no subscription, which suits traffic that triples for a launch and settles again a fortnight later.
