{
  "id": "MSG-106",
  "slug": "msg-106",
  "title": "Link domains must not appear in threat intelligence",
  "statement": "Domains appearing in message content must not be flagged by threat-intelligence sources.",
  "rationale": "Carriers screen destinations against reputation databases, so a link to a compromised or previously-abused domain gets the campaign filtered regardless of how clean the registration is. Shared hosting and recycled domains are the usual innocent cause.",
  "layer": "MESSAGE_CONTENT",
  "layerSlug": "message-content",
  "object": "campaign.sample[] link domains",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_EXTERNAL",
  "authorities": [
    "CTIA",
    "T-Mobile",
    "Twilio"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Check every domain you link against Google Safe Browsing and VirusTotal before registering, and move off any flagged host. A previously-abused domain will not clear simply by waiting.",
  "notes": "Needs a reputation lookup the product does not have; surfaced as a warning with the check the user should run themselves.",
  "phase": "approval",
  "automated": true,
  "attestation": {
    "question": "Is every domain you link to in these messages clean on Google Safe Browsing and VirusTotal today?",
    "howToCheck": [
      "List the domains in the sample messages, including link-shortener destinations.",
      "Check each against Google Safe Browsing and VirusTotal.",
      "Move off any flagged host — a previously abused domain will not clear simply by waiting."
    ],
    "failureLooksLike": "A recycled domain or a shared host carries somebody else's history into your campaign, and the traffic is filtered regardless of how clean the registration is."
  },
  "url": "https://ekas.io/rules/10dlc/message-content/msg-106/",
  "markdown": "https://ekas.io/rules/10dlc/message-content/msg-106.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}