How do I verify applicant business websites during underwriting?

The problem

An insurer evaluating a business application needs to verify the applicant's website. A claimed "established business" with a 3-day-old domain, a parked website, or no MX record is a red flag for potential fraud. Manual verification doesn't scale when processing hundreds of applications.

Fraudulent applications with fake business websites cost the industry billions. A domain that was registered two days before the application was submitted is a pattern worth catching automatically.

How Unphurl solves it

When an applicant submits a business website, check it through Unphurl as part of the underwriting workflow. You get structured signals: domain age, parking status, SSL health, MX records, and brand impersonation detection. Established businesses with real infrastructure pass clean. Freshly created shells, parked placeholders, and impersonation attempts get flagged for closer review.

Signals that matter for this use case

• – Parked domain means the applicant's claimed business website is just a placeholder. No real operation behind it.
• – Domain age <3 days is the strongest fraud signal. The domain was created days before the application.
• – Domain age <7 days flags domains created in the past week, common in staged fraud attempts
• – Domain age <30 days identifies recently created domains that warrant additional scrutiny
• – Brand impersonation catches domains mimicking well-known companies with typosquatting or lookalike names
• – No MX record means the domain can't receive email. A legitimate business has email.
• – High domain entropy identifies randomly generated domain names often used by throwaway sites
• – Expiring soon means the domain registration is about to lapse. Not consistent with an established business.
• – Bad domain status (pendingDelete, serverHold) means the domain is in trouble at the registrar level
• – SSL invalid signals a neglected or abandoned web presence
• – HTTP only means no SSL at all, unusual for any real business operation

Suggested scoring profile

{
  "name": "underwriting",
  "weights": {
    "parked": 30,
    "domain_age_3": 35,
    "domain_age_7": 25,
    "domain_age_30": 15,
    "brand_impersonation": 20,
    "no_mx_record": 15,
    "domain_entropy_high": 10,
    "expiring_soon": 15,
    "domain_status_bad": 20,
    "ssl_invalid": 15,
    "http_only": 10
  }
}

What a result looks like

An applicant claims to operate "Established Contractors" and submits established-contractors.biz as their business website:

Score 50. The domain was registered 2 days ago and has no email infrastructure. For a business claiming to be "established," this is a clear mismatch. The application is flagged for closer review before the policy is issued.

Cost

One URL per application, checked in real time. Established business domains often resolve free from the Tranco list or cache. Only truly unknown domains cost a pipeline check. The Starter package covers hundreds of applications.

Get started

For developers: Add a single API call to your underwriting workflow.

# Check an applicant's business website
curl -s https://api.unphurl.com/v1/check \
  -H "Authorization: Bearer uph_your_key_here" \
  -d '{"url": "https://established-contractors.biz", "profile": "underwriting"}'

# Or batch check multiple applicants
unphurl --batch applicant-websites.csv --profile underwriting --json | \
  jq -r '.results[] | select(.result.score >= 30) | "\(.url): score \(.result.score)"'