Phishing sent through
your invite emails
Attackers sign up, then use your invite, share and notification emails to send phishing and callback scams from your trusted domain.
Recent campaigns
2026 campaigns abused SaaS notification systems such as GitHub and Jira, OpenAI team invitations and Amazon Business invites. The mail is genuine, so SPF, DKIM and domain reputation all pass.
How it works
Call before you send
Your backend posts the account, the kind of email, the recipients and the user-controlled text to
/v1/outboundbefore any user-triggered email leaves.Get a decision
allow sends the email, review holds it for manual approval and block drops it. Reasons cover new-account fan-out, bursts, recipient domain spread, lure text and already flagged accounts.
Review in the dashboard
Settings → Outbound abuse lists recent decisions and the thresholds behind them. An
outbound.abusewebhook fires once per account per day.
API
POST /v1/outbound
{"accountId":"user_42","kind":"invite","recipients":["a@example.com","b@example.com"],"text":"Call 1-800-555-0137 about your invoice"}
{"decision":"block","reasons":["outbound_lure","outbound_new_account"]}The Node SDK call is await nolgard.outbound({ accountId, kind: 'invite', recipients, text }) and fails open, so your email pipeline keeps running. The text is evaluated in memory and never stored; only counts and hashed recipient domains are kept, for 7 days.
Limits
- Defaults are logical starting points and carry no measured guarantee. Tune them for how your product sends email.
- A real user onboarding a whole team on day one looks like a new-account burst.
- Product emails that legitimately contain links, phone numbers or billing words can match the lure reason.
- Freemail recipients count as one domain, so a consumer invite list spreads less than a corporate one.
- Nolgard decides; it does not send, queue or withhold email. Your backend owns delivery.
- Counts and hashed recipient domains cover 7 days. Older activity is not visible to the detectors.