Whitelisted domains

A whitelisted domain is a domain you own that Anti-Phishing must never report as phishing. Add every domain of yours that looks like your brand but is not the main domain of the project: otherwise the scanner finds it, treats it as a look-alike, and shows it among phishing and similar domains.

Main domain and whitelisted domains

A project has two kinds of domains:

	Main domain	Whitelisted domains
Purpose	The site Anti-Phishing protects. The scanner uses it as the reference when it compares look-alike domains.	Your other domains. They are only excluded from detection.
How many	One per project	Any number
Ownership verification	Required	Not required
Opened by the scanner	Yes	No

When to add a whitelisted domain

• Brand domains that are not live yet. A domain you registered in advance can return 404 or a parking page. The scanner sees a new domain with your brand name and flags it.
• Mirrors and regional domains. For example, example.net, example-app.com or example.com.tr next to the main example.com.
• Service hosts. Hosts that carry your brand name but serve infrastructure: CDN, API, payment pages, authentication, landing pages.
• A domain you already saw in the list of phishing or similar domains, but it is yours. Whitelist it so it does not show up again.

Do not whitelist a domain you do not control. A whitelisted domain is never checked, so a real clone on it would go unnoticed.

How to add a whitelisted domain

1. Open the Anti-Phishing project. In the project details, find the Domains row and click Edit.

   

2. The Domains panel opens. It has two sections: Domain with the main domain, and Whitelisted domains. In the Whitelisted domains section, click Add domain.

   

3. In the Add domain form, enter the domain in the Domain field, for example example.net. Optionally, add a Note that explains what the domain is, for example "Turkish mirror" or "Payment page". Click Add.

   

4. The domain appears in the Whitelisted domains list. Repeat the steps for every domain you want to exclude.

   

Manage whitelisted domains through the API

If your domains change often, for example when you rotate mirrors, update the whitelist from your own deployment or rotation script instead of the dashboard. See the Project domains section of the API reference: it covers adding, listing and deleting domains.

Always send "status": "WHITELISTED" when you add a domain. A domain sent without a status replaces the main domain of the project.

Remove a domain as soon as you stop owning it, for example when you let its registration expire. While it stays whitelisted, the scanner does not check it, so a clone that a new owner puts on it goes unnoticed.

What to keep in mind

• Add each host exactly. The domain is matched exactly, so example.net does not cover pay.example.net. Add every subdomain you need as a separate entry.
• The change takes effect within 5 minutes. Until then, the scanner may still report the domain.
• You can remove a whitelisted domain at any time. Click the remove icon next to it in the Whitelisted domains list. After that, the scanner checks the domain like any other.