{
  "id": "WEB-136",
  "slug": "web-136",
  "title": "No malware or insecure downloads served from the site",
  "statement": "The brand website must not host or promote malware, or application downloads served from non-secure locations.",
  "rationale": "A link in a text message that ends in a drive-by download is the highest-severity outcome in the whole framework, so the destination is screened for it directly. The common cause is not malice: an unmaintained plugin on a small business site gets compromised, the owner never sees the injected script, and the first they hear of it is a registration refusal that says nothing about their site being hacked.",
  "layer": "WEBSITE",
  "layerSlug": "website",
  "object": "crawled website content",
  "severity": "BLOCKING",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "CTIA",
    "AT&T"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Scan and clean the site, update the platform and plugins, and serve every download over https from your own domain. Done when a safe-browsing check on the domain comes back clear and no download link points at a plain-HTTP host.",
  "example": "App links point at https://apps.apple.com/... and https://play.google.com/... rather than at a self-hosted APK.",
  "pitfalls": [
    "Cleaning the site does not clear the blocklist entry. Request a review with the safe-browsing service as well, or the domain reputation rules keep failing after the malware is gone."
  ],
  "notes": "The landing-page malware screen is routed to WEBSITE by the catalog's layer-ownership rule, so it carries no MESSAGE_CONTENT alias: the message-side row was folded into this obligation rather than kept as a separate one.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/website/web-136/",
  "markdown": "https://ekas.io/rules/10dlc/website/web-136.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}