# Reason codes

Each signal Bewary finds has a stable code, such as DOMAIN_LOOKALIKE_BRAND_WORD or LISTED_BLOCKLIST. reason_codes lists the codes that decided the verdict, strongest first. Codes are only ever added, never renamed, so they are safe to store and to branch on.

Live: the engine emits it today. Reserved: in the contract so clients can handle it, emitted once its source ships.

| Code | Entity | Severity | Source | Meaning | Status |
|---|---|---|---|---|---|
| `LISTED_BLOCKLIST` | any | critical | confirmed | On scam blocklist | live |
| `TEXT_SCAM_PLAYBOOK` | message | high | heuristic | Scam playbook | live |
| `TEXT_SCAM_TACTIC` | message | medium | heuristic | Scam tactic | live |
| `TEXT_MULTIPLE_TELLS` | message | medium | heuristic | Multiple scam tells | live |
| `TEXT_SCAM_WORDING` | message | medium | heuristic | Common scam wording | live |
| `DOMAIN_ALLOWLISTED` | domain | info | first_party | Established domain (allowlist) | live |
| `DOMAIN_AGE_GT_1Y` | domain | info | first_party | Established domain | live |
| `DOMAIN_AGE_90D_1Y` | domain | info | first_party | Established domain (<1y) | live |
| `DOMAIN_AGE_30_90D` | domain | medium | heuristic | Recently-registered domain | live |
| `DOMAIN_AGE_LT_30D` | domain | medium | heuristic | Brand-new domain | live |
| `DOMAIN_MULTITENANT_PLATFORM` | domain | info | heuristic | Hosted on a public platform | live |
| `DOMAIN_AGE_UNKNOWN` | domain | info | heuristic | Domain age unknown | live |
| `DOMAIN_LOOKALIKE_BRAND_WORD` | domain | medium | heuristic | Lookalike domain | live |
| `DOMAIN_MIXED_SCRIPT` | domain | high | heuristic | Fake domain (mixed alphabets) | live |
| `DOMAIN_HOMOGLYPH_BRAND` | domain | high | heuristic | Fake domain (homoglyph) | live |
| `DOMAIN_BRAND_ON_ABUSED_TLD` | domain | high | heuristic | Fake domain (brand + suspicious TLD) | live |
| `DOMAIN_TYPO_BRAND` | domain | medium | heuristic | Possible fake domain (typo) | live |
| `DOMAIN_BRAND_SCAM_WORD` | domain | medium | heuristic | Possible fake domain (brand + scam word) | live |
| `TLD_HIGH_ABUSE` | domain | medium | heuristic | Risky domain | live |
| `URL_LISTED_THREAT_INTEL` | url | critical | confirmed | Known dangerous link | live |
| `URL_HIGH_RISK_SCORE` | url | high | heuristic | High-risk link | live |
| `URL_SUSPICIOUS_SCORE` | url | medium | heuristic | Suspicious link | live |
| `PAGE_MALICIOUS` | url | high | attacker_content | Dangerous page | live |
| `EMAIL_DISPOSABLE` | email | high | heuristic | Disposable email | live |
| `EMAIL_SENDER_DOMAIN_FORGED` | email | high | heuristic | Forged sender domain | live |
| `EMAIL_DOMAIN_NO_MX` | email | medium | heuristic | Domain can't receive email | live |
| `EMAIL_FREE_PROVIDER` | email | medium | heuristic | Free email address | live |
| `EMAIL_HIGH_RISK` | email | high | confirmed | High-risk sender | live |
| `EMAIL_RISKY` | email | medium | heuristic | Risky sender | live |
| `PHONE_INVALID` | phone | medium | heuristic | Invalid number | live |
| `PHONE_UNPARSEABLE` | phone | info | heuristic | Number unreadable | live |
| `PHONE_VOIP` | phone | medium | first_party | VoIP / virtual number | live |
| `PHONE_RISK_FLAGGED` | phone | medium | heuristic | Flagged number | live |
| `PHONE_PUBLIC_SCAM_REPORTS` | phone | medium | heuristic | Reported scam number | live |
| `PHONE_NO_PUBLIC_LISTING` | phone | info | heuristic | No public listing | live |
| `IMAGE_DEPICTS_SCAM` | message | high | attacker_content | Scam screenshot | live |
| `CAMPAIGN_WIDESPREAD` | message | high | confirmed | Widely-circulating scam (≥5 in 7 days) | live |
| `CAMPAIGN_SEEN_BEFORE` | message | medium | heuristic | Reported before (2-4) | live |
| `BRAND_CHANNEL_MISMATCH` | message | high | heuristic | Doesn't match the real organization | live |
| `OPERATOR_PREDATORY` | message | medium | heuristic | Known for predatory fees | live |
| `DOMAIN_DECEPTIVE_STRUCTURE` | domain | high | heuristic | A brand name placed before an @ so the real host hides after it | live |
| `SHORTCODE_LEGITIMATE` | shortcode | info | first_party | A short code a real company sends from | live |
| `SHORTCODE_MIXED_USE` | shortcode | medium | first_party | A shared short code used by several senders | live |
| `SHORTCODE_SCAM` | shortcode | high | confirmed | A short code known for scam texts | live |
| `SHORTCODE_UNREGISTERED` | shortcode | low | heuristic | A short code not in the directory | live |
| `IP_LISTED` | ip | high | confirmed | An address on a confirmed abuse list | live |
| `IP_DATACENTER_FOR_SENDER` | ip | low | heuristic | A sender hosted in a datacenter, not a home or business network | live |
| `PHONE_FTC_COMPLAINTS` | phone | medium | confirmed | Complaints about this number at the FTC | live |
| `PHONE_FCC_COMPLAINTS` | phone | medium | confirmed | Complaints about this number at the FCC | live |
| `PHONE_HONEYPOT_HIT` | phone | high | confirmed | Called our honeypot lines | live |
| `DOMAIN_CERT_LT_48H` | domain | medium | first_party | First TLS certificate issued in the last 48 hours | live |
| `URL_SHORTENER` | url | info | first_party | Uses a link shortener | live |
| `URL_REDIRECT_CROSS_DOMAIN` | url | medium | first_party | Redirects to a different domain | live |
| `WALLET_LISTED` | wallet | critical | confirmed | A wallet on a confirmed scam list | live |
| `WALLET_SANCTIONED` | wallet | high | confirmed | A wallet on a US sanctions list | live |
| `LISTED_CAUTION` | any | medium | heuristic | On a broad threat list that also holds spam and malware hosts | live |
| `PHONE_REPORTED_CALLER_ID` | phone | medium | heuristic | Shown as the caller ID of complained-about calls, which callers can fake | live |
| `PROTECTIVE_DNS_BLOCKED` | domain | medium | heuristic | Blocked by public protective DNS resolvers | live |
| `PLATFORM_TAKEDOWN` | any | high | confirmed | The hosting platform took it down | live |
| `PLATFORM_WARNING` | any | high | confirmed | The platform shows a phishing or malware warning in front of it | live |
| `DOMAIN_REGISTRY_HOLD` | domain | high | first_party | The registry holds the domain out of the DNS | live |
| `DOMAIN_REGISTRAR_HOLD` | domain | medium | first_party | The registrar suspended the domain | live |
| `HANDLE_REPORTED` | payment_handle | medium | heuristic | A payment handle reported in scams | live |
| `IBAN_CHECKSUM_INVALID` | iban | medium | heuristic | The IBAN fails its check digits | live |
| `IBAN_FORMAT_INVALID` | iban | medium | heuristic | Not a valid IBAN for its country | live |
| `IBAN_COUNTRY_MISMATCH` | iban | medium | heuristic | The account is in another country than the payee claims | live |
| `APP_REMOVED` | app | medium | first_party | The store pulled the app | live |
| `SHORTLINK_DISABLED` | url | high | confirmed | The link shortener disabled the link | live |
| `SHORTLINK_WARNING` | url | medium | heuristic | The link shortener warns before the destination | live |
| `HANDLE_INACTIVE` | payment_handle | medium | heuristic | The payment profile is not active | live |
| `TEXT_PAYMENT_REQUEST` | message | medium | model | Asks for a payment | live |
| `TEXT_CREDENTIAL_REQUEST` | message | high | model | Asks for a password or login | live |
| `TEXT_CODE_REQUEST` | message | high | model | Asks for a one-time code | live |
| `TEXT_URGENCY` | message | low | model | Pushes the reader to act fast | live |
| `TEXT_THREAT` | message | medium | model | Threatens a penalty, arrest or lost account | live |
| `TEXT_UNEXPECTED_REWARD` | message | medium | model | Offers a prize, refund or money out of nowhere | live |
| `TEXT_CALLBACK_REQUEST` | message | medium | model | Asks the reader to call a number | live |
| `TEXT_SENDER_BRAND_MISMATCH` | message | high | model | The sender does not match the brand it claims to be | live |
| `TEXT_LINK_BRAND_MISMATCH` | message | high | model | The link does not go to the brand it claims to be | live |
| `PAGE_CREDENTIAL_HARVEST` | url | high | model | The page asks for a login it should not | live |
| `PAGE_PAYMENT_HARVEST` | url | high | model | The page asks for card or bank details it should not | live |
| `CLASS_OWN_RECORD` | message | info | model | The user's own receipt or record, not an inbound message | live |
| `CLASS_NOT_SECURITY_RELEVANT` | message | info | model | Nothing to judge: no request, link or claim | live |