Reason codes
Each signal Bewary finds has a stable code, such as DOMAIN_LOOKALIKE_BRAND_WORD or LISTED_BLOCKLIST. reason_codes lists the codes that decided the verdict, strongest first. Codes are only ever added, never renamed, so they are safe to store and to branch on.
Live codes are emitted by the engine today. Reserved codes are in the contract so your code can handle them, and start appearing when their source ships.
Links
| Code | Meaning | Severity | Status |
|---|
URL_LISTED_THREAT_INTEL | Known dangerous link | Critical | Live |
URL_HIGH_RISK_SCORE | High-risk link | High | Live |
URL_SUSPICIOUS_SCORE | Suspicious link | Medium | Live |
PAGE_MALICIOUS | Dangerous page | High | Live |
URL_SHORTENER | Uses a link shortener | Info | Live |
URL_REDIRECT_CROSS_DOMAIN | Redirects to a different domain | Medium | Live |
SHORTLINK_DISABLED | The link shortener disabled the link | High | Live |
SHORTLINK_WARNING | The link shortener warns before the destination | Medium | Live |
PAGE_CREDENTIAL_HARVEST | The page asks for a login it should not | High | Live |
PAGE_PAYMENT_HARVEST | The page asks for card or bank details it should not | High | Live |
Domains
| Code | Meaning | Severity | Status |
|---|
DOMAIN_ALLOWLISTED | Established domain (allowlist) | Info | Live |
DOMAIN_AGE_GT_1Y | Established domain | Info | Live |
DOMAIN_AGE_90D_1Y | Established domain (<1y) | Info | Live |
DOMAIN_AGE_30_90D | Recently-registered domain | Medium | Live |
DOMAIN_AGE_LT_30D | Brand-new domain | Medium | Live |
DOMAIN_MULTITENANT_PLATFORM | Hosted on a public platform | Info | Live |
DOMAIN_AGE_UNKNOWN | Domain age unknown | Info | Live |
DOMAIN_LOOKALIKE_BRAND_WORD | Lookalike domain | Medium | Live |
DOMAIN_MIXED_SCRIPT | Fake domain (mixed alphabets) | High | Live |
DOMAIN_HOMOGLYPH_BRAND | Fake domain (homoglyph) | High | Live |
DOMAIN_BRAND_ON_ABUSED_TLD | Fake domain (brand + suspicious TLD) | High | Live |
DOMAIN_TYPO_BRAND | Possible fake domain (typo) | Medium | Live |
DOMAIN_BRAND_SCAM_WORD | Possible fake domain (brand + scam word) | Medium | Live |
TLD_HIGH_ABUSE | Risky domain | Medium | Live |
DOMAIN_DECEPTIVE_STRUCTURE | A brand name placed before an @ so the real host hides after it | High | Live |
DOMAIN_CERT_LT_48H | First TLS certificate issued in the last 48 hours | Medium | Live |
PROTECTIVE_DNS_BLOCKED | Blocked by public protective DNS resolvers | Medium | Live |
DOMAIN_REGISTRY_HOLD | The registry holds the domain out of the DNS | High | Live |
DOMAIN_REGISTRAR_HOLD | The registrar suspended the domain | Medium | Live |
Phone numbers
| Code | Meaning | Severity | Status |
|---|
PHONE_INVALID | Invalid number | Medium | Live |
PHONE_UNPARSEABLE | Number unreadable | Info | Live |
PHONE_VOIP | VoIP / virtual number | Medium | Live |
PHONE_RISK_FLAGGED | Flagged number | Medium | Live |
PHONE_PUBLIC_SCAM_REPORTS | Reported scam number | Medium | Live |
PHONE_NO_PUBLIC_LISTING | No public listing | Info | Live |
PHONE_FTC_COMPLAINTS | Complaints about this number at the FTC | Medium | Live |
PHONE_FCC_COMPLAINTS | Complaints about this number at the FCC | Medium | Live |
PHONE_HONEYPOT_HIT | Called our honeypot lines | High | Live |
PHONE_REPORTED_CALLER_ID | Shown as the caller ID of complained-about calls, which callers can fake | Medium | Live |
Short codes
| Code | Meaning | Severity | Status |
|---|
SHORTCODE_LEGITIMATE | A short code a real company sends from | Info | Live |
SHORTCODE_MIXED_USE | A shared short code used by several senders | Medium | Live |
SHORTCODE_SCAM | A short code known for scam texts | High | Live |
SHORTCODE_UNREGISTERED | A short code not in the directory | Low | Live |
Email addresses
| Code | Meaning | Severity | Status |
|---|
EMAIL_DISPOSABLE | Disposable email | High | Live |
EMAIL_SENDER_DOMAIN_FORGED | Forged sender domain | High | Live |
EMAIL_DOMAIN_NO_MX | Domain can't receive email | Medium | Live |
EMAIL_FREE_PROVIDER | Free email address | Medium | Live |
EMAIL_HIGH_RISK | High-risk sender | High | Live |
EMAIL_RISKY | Risky sender | Medium | Live |
IP addresses
| Code | Meaning | Severity | Status |
|---|
IP_LISTED | An address on a confirmed abuse list | High | Live |
IP_DATACENTER_FOR_SENDER | A sender hosted in a datacenter, not a home or business network | Low | Live |
Wallets
| Code | Meaning | Severity | Status |
|---|
WALLET_LISTED | A wallet on a confirmed scam list | Critical | Live |
WALLET_SANCTIONED | A wallet on a US sanctions list | High | Live |
IBANs
| Code | Meaning | Severity | Status |
|---|
IBAN_CHECKSUM_INVALID | The IBAN fails its check digits | Medium | Live |
IBAN_FORMAT_INVALID | Not a valid IBAN for its country | Medium | Live |
IBAN_COUNTRY_MISMATCH | The account is in another country than the payee claims | Medium | Live |
Mobile apps
| Code | Meaning | Severity | Status |
|---|
APP_REMOVED | The store pulled the app | Medium | Live |
Payment handles
| Code | Meaning | Severity | Status |
|---|
HANDLE_REPORTED | A payment handle reported in scams | Medium | Live |
HANDLE_INACTIVE | The payment profile is not active | Medium | Live |
Any entity
| Code | Meaning | Severity | Status |
|---|
LISTED_BLOCKLIST | On scam blocklist | Critical | Live |
LISTED_CAUTION | On a broad threat list that also holds spam and malware hosts | Medium | Live |
PLATFORM_TAKEDOWN | The hosting platform took it down | High | Live |
PLATFORM_WARNING | The platform shows a phishing or malware warning in front of it | High | Live |