# MSG-106 — Link domains must not appear in threat intelligence

> Domains appearing in message content must not be flagged by threat-intelligence sources.

- **Rule ID:** MSG-106
- **Layer:** Message content (`MESSAGE_CONTENT`)
- **Checks:** `campaign.sample[] link domains`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Wait on an external system or a required interval
- **Required by:** CTIA, T-Mobile, Twilio
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/message-content/msg-106/

## Why this rule exists

Carriers screen destinations against reputation databases, so a link to a compromised or previously-abused domain gets the campaign filtered regardless of how clean the registration is. Shared hosting and recycled domains are the usual innocent cause.

## How to fix it

Check every domain you link against Google Safe Browsing and VirusTotal before registering, and move off any flagged host. A previously-abused domain will not clear simply by waiting.

## Check this yourself

**Is every domain you link to in these messages clean on Google Safe Browsing and VirusTotal today?**

1. List the domains in the sample messages, including link-shortener destinations.
2. Check each against Google Safe Browsing and VirusTotal.
3. Move off any flagged host — a previously abused domain will not clear simply by waiting.

*What wrong looks like:* A recycled domain or a shared host carries somebody else's history into your campaign, and the traffic is filtered regardless of how clean the registration is.

## Notes

Needs a reputation lookup the product does not have; surfaced as a warning with the check the user should run themselves.