A load is tendered, a carrier is onboarded, an invoice is factored and a payment is released — often inside forty-eight hours, often between parties who have never met. That tempo is what makes freight work, and it is exactly what makes a look-alike domain worth registering. This page is about putting a DNS-verified list of currently-live phishing hosts in front of the moments where money and cargo change hands.
Most sectors phish badly because their staff are busy. Logistics phishes badly because its normal, correct, everyday behaviour is indistinguishable from the attack.
Consider what a broker's operations desk actually does in a shift. It receives load tenders from shippers it may have worked with twice, accepts capacity from carriers whose entire prior relationship is an MC number and a certificate of insurance emailed as a PDF, and exchanges rate confirmations, bills of lading and packet requests with a dozen counterparties nobody there will ever speak to on the phone. There is no version of that job in which "be suspicious of unexpected documents from unfamiliar parties" is workable advice, because unexpected documents from unfamiliar parties are the job.
A single box from an inland factory to a distribution centre passes through a forwarder, an ocean carrier, a terminal, a drayage operator, a customs broker, a warehouse, a line-haul carrier and a last-mile fleet — most of them small, several with no IT function, all of them needing to talk to each other in writing.
An attacker never has to compromise the largest party. They take the least defended one, and from that point they send perfectly ordinary messages from a genuine address to everybody else. Third-party risk is not a governance abstraction in freight; it is a literal description of how the cargo moves.
Carrier-branded tracking notices, exception alerts, customs-charge requests and redelivery links are among the most imitated messages in circulation precisely because they are so common nobody finds them remarkable — so the lure is not a trick to fall for, it is a plausible event that happens to be false.
At the moment of reading, the fraudulent message and the genuine one are identical. A list of hostnames verified as currently-live credential-harvesting infrastructure does not care how convincing the wording was, how real the deadline felt, or how many times the reader has done this before.
The characteristic freight fraud is not a dramatic breach. It is a remittance-detail change: a message arrives from a carrier, a factoring company or a forwarder saying banking details have been updated and the next settlement should go to a new account. It is well written, references a genuine load number, and lands at exactly the point in the settlement cycle when a change would be unremarkable.
One character transposed, a hyphen inserted, a different top-level domain — and a payables clerk who did not scrutinise the sender in a threaded conversation on a phone screen. This is the variant a verified phishing-domain check addresses directly and materially, because the hostile hostname is the thing being checked.
The message comes from the genuine domain, because the counterparty's mailbox is compromised and the attacker is replying inside an existing conversation. A domain check does nothing here, and it would be dishonest to imply otherwise — that one needs callback verification to a number you already held, which is a process control rather than a technical one.
The credential-harvesting page that took your counterparty's mailbox in the first place very often lives on a hostname already in this database. Adjacent patterns are covered on our supply chain and email security pages.
Carrier identity theft has a specific mechanical shape. An attacker obtains the credentials or the operating identity of a legitimate carrier, presents that identity to a broker, accepts a load, and either re-brokers it to an unwitting third carrier while collecting the payment, or arranges for the freight to be collected and never delivered. The theft of the login precedes the theft of the cargo, sometimes by weeks.
The properties that matter to a logistics operator are not the ones usually marketed: freshness, verification standard, and whether the thing still works when a depot's uplink does not.
Inclusion requires an active A record, confirmed through rotating proxy infrastructure. That single rule changes the character of the list: it is not an accumulating archive of everything anybody ever reported, because hosts that stop resolving fall out. What remains — 390,000 or more domains at any given moment — is a picture of infrastructure that is standing up and answering right now, which for a sector whose adversaries register a hostname on Monday and abandon it on Friday is worth more than a bigger list that never forgets anything.
The changelog is the part operations teams care about. The rebuild completes daily at 04:30 UTC with a list of additions and removals alongside it, which turns the update from a full reload into a diff. A depot resolver applying a few thousand adds and removes finishes in a maintenance window measured in seconds; a full file replacement every morning is the kind of job that eventually collides with a peak-season change freeze.
Two delivery shapes, for two parts of the estate. The /feed endpoint hands you the whole database as CSV — domain,category,dns_status — or as JSON, with unlimited downloads on a subscription, so every depot and 3PL site can hold its own copy with no per-site metering. The /check and /batch endpoints suit workflow integration, where a specific set of hostnames needs a verdict inside a business process: a carrier packet, a settlement run, a customs document set.
A depot on a congested or failing uplink still resolves against a local copy of the list. There is no verdict service to be unreachable during the exact incident you needed it for.
Sub-50ms responses and a rate limit of ten requests per second per key mean a check can sit inline in a booking or onboarding path without becoming the slowest step in it.
Confidence is 0.98 for a confirmed match and 0.0 for no match — no middle band to interpret, which makes the result easy to record on a vetting file or a payment hold.
Five points, in the order freight and money actually move. Each is a place where a verified hostname verdict changes a decision rather than merely generating a report.
Every hostname on the submitted packet — website, certificate links, contact mail domains — batched in one call before a human opens the file.
Links in tender and rate-confirmation traffic screened at the mail gateway, so a fake load-board or portal page never reaches the dispatcher's screen.
Customs-charge, redelivery and detention notices are the highest-volume lure family in freight. Screen them where they arrive, including on the consignee side.
Any request to alter banking, remittance or contact details re-enters screening automatically, regardless of which mailbox it appears to come from.
The payment job batches the hostnames in the correspondence trail and holds the run on a confirmed match, rather than relying on a clerk to escalate.
checked, phishing_found and credits_used so the job can log one line per run.Head-office controls do not reach the yard. The operational reality at the edge is personal phones, shared terminals and a site whose IT support is a phone number.
A driver's phone is the most exposed device in the whole estate and usually the least governed. It carries dispatch messages, delivery instructions, proof-of-delivery prompts, fuel-card notifications and increasingly telematics and hours-of-service alerts. In a large fleet some of that arrives through a managed app; for a small fleet or an owner-operator, all of it arrives as text messages and personal email on a handset the company neither owns nor administers.
The distinction worth carrying into a management meeting: every other control in this industry asks somebody to notice something. A resolver holding a verified list of live hostile hosts asks nobody to notice anything — it simply removes the destination, at three in the morning, on a shift with agency staff, during peak, when nobody is watching.
Most operators end up running two of them. The table is about being deliberate rather than accumulating tools by accident.
| Placement | Covers | Misses | Effort | Commercial shape |
|---|---|---|---|---|
| Site / depot resolver | Every device on the site, including unmanaged ones | Cellular traffic, devices using their own encrypted DNS | Low — a scheduled download and a reload | Feed subscription |
| Mail gateway | Links in tenders, invoices, customs and exception notices | Anything arriving by text, messaging app or in-app chat | Medium — a hook into the existing scanning pipeline | Feed for volume, batch API for sampling |
| Carrier / vendor onboarding | Hostnames supplied on packets and change requests | A legitimate carrier compromised later | Low — a batch call inside an existing workflow | Credit package |
| Payment release job | The final gate before funds move | Thread hijacking from a genuine, compromised mailbox | Low — one call and one hold condition | Credit package |
This is a known-bad lookup. A confirmed match means a hostname was observed, verified as resolving and confirmed as phishing infrastructure. A clean result means "not on the list" — never "safe". A domain registered this morning and first used this afternoon will not appear yet, and a compromised legitimate supplier never will, because their domain is not hostile.
Freight-targeted phishing infrastructure is rarely bespoke. The same kits and hosting get reused across campaigns, so hostnames aimed at one broker on Tuesday are frequently in the database before they are aimed at another on Thursday. Weakest against a patient adversary building one domain for one target; strongest against the industrialised volume that fills a dispatcher's inbox.
A floor, not a ceiling. Resolver placement plus one workflow placement — vetting or settlement — covers the two failure modes that cost this industry most, and neither needs a security team day to day. Operators building further usually add incident response tooling and, once there is a SOC, the SIEM integration pattern.
Two spending shapes. One is small enough to sit inside an operations budget without a procurement cycle; the other is a network-wide subscription that does not move with your volume.
The record counts are small, so the arithmetic is too: a brokerage onboarding two hundred carriers a month and screening five hostnames per packet spends a thousand credits a month plus whatever the settlement job uses. the Growth plan is $99/month for 25,000 lookups at $0.0040 per lookup, $99 Growth is 25,000 , and $249 Professional is 100,000 at $0.0025 — a year or more of screening for most brokers. lookups reset monthlyfewer than ten percent have been used.
The Daily Threat Feed is $499 per month or $499/month — a third off. It adds historical archive access, priority support, custom format options, a dedicated account manager and 100,000 API credits, which covers the vetting and settlement work above without a second purchase. Downloads are unlimited, so a forwarder with forty branch offices and a 3PL with sixty depots pay exactly what an operator with one site pays.
For a two-truck fleet neither figure is the right starting point and it would be silly to pretend otherwise. The realistic path is the one small carriers already use for compliance services: a group arrangement through an association, or the 3PL or broker they haul for running protection at network level on their behalf. If you are the larger party in a chain of small ones, extending your resolver to a partner site is a configuration line rather than another subscription.
Monthly plans range from Business at $499/month for 250,000 lookups, $999/month for 750,000 lookups, Enterprise at $999/month for 750,000 lookups and Enterprise at $999/month for 750,000 lookups per lookup, and bank transfer replaces PayPal above $4,000 for finance functions that do not use cards. SFTP or S3 delivery into an existing pipeline, STIX/TAXII for a security operations centre, a custom update frequency, an SLA or on-premise deployment are quoted rather than listed — the full table is on the pricing page and delivery options on the daily feed page.
One note for the business case, without an invented figure attached. The costs this control addresses are lumpy rather than continuous — a diverted settlement, a load collected by a carrier who was not who they claimed to be, a depot disrupted by malware delivered through an exception notice. Any one of them exceeds a year of either spending shape, which is why the useful question in a board paper is not the expected saving but the number of settlement runs and carrier packets that currently pass through with no automated hostname check at all.
/stats endpoint requires no API key, no credits and no authentication. You can confirm the current database size and last update date before any commercial conversation begins. Full endpoint detail is in the API documentation.The objections below come up in nearly every conversation with a carrier, broker or forwarder, and most of them deserve a direct answer rather than reassurance.
Two things. First, coverage of paths your mail product does not see: hostnames supplied on a carrier packet, links in a load-board message, a URL a dispatcher types from a phone call, a redelivery notice arriving at a depot's shared terminal. Second, a different verification standard — every domain here has been confirmed as currently resolving, so the list reflects live infrastructure rather than accumulated reports.
Not on its own, and anyone claiming otherwise is overselling. Double-brokering is a fraud committed with a stolen or fabricated operating identity, and stopping it requires authority verification, insurance validation, carrier history and often a phone call to a number you sourced independently.
This is the case the feed model exists for. You download the full database once a day — a single authenticated call to /feed, CSV or JSON — and every subsequent match happens locally on your own resolver or firewall. Nothing is asked of an external service at lookup time, so a site with a saturated or intermittent uplink still gets the full benefit.
Plan for it and it is a non-event. Keep a local allow-list that your reload script applies after each daily import, so an override survives the next update rather than having to be re-applied. Make the block page say which organisation blocked it and give a route to a person, because a dispatcher who hits a false positive at 06:00 needs it resolved in minutes, not raised as a ticket.
No, and it must not. The API key is the username chosen at registration and it is a server-side secret. If it ships inside a mobile app it can be extracted from the binary, and whoever does so is spending your credits.
It helps with the hostname, which is the part of that lure that is mechanically checkable. Messages claiming an outstanding duty or clearance fee on a real shipment are among the most productive attacks in international freight, because the underlying event is plausible and the recipient often cannot verify the charge quickly through any other channel.
The database is rebuilt every 24 hours, with the build landing at 04:30 UTC, and each domain is DNS-verified through rotating proxy infrastructure so only hosts with an active A record are included. That standard is why entries fall out when they stop resolving instead of accumulating indefinitely.
is_phishing, a category of phishing/malware, a dns_status of resolves, a last_checked date, and a confidence of 0.98 for a confirmed match against 0.0 for no match. There is no partial score in between, which makes the result straightforward to act on in an automated workflow — a hold or a pass, not a judgement call.If you run your own resolver, or a firewall with a blocklist feature, it is an afternoon's work for whoever maintains that box: a scheduled download, a file validity check, a reload. If you do not, the honest answer is that the feed is not the right starting point for you.
Screen carrier packets and settlement runs with a monthly plan, or load the daily feed into the resolvers serving your depots, offices and 3PL sites so every device inherits the same protection without an agent.
