{"version":2,"formula":"deception x capability x freshness x reputation x discounts","components":[{"name":"deception","asks":"How convincing is the name?","range":"0.25 to almost 1","signals":[{"code":"brand_token","value":"+0.60","says":"Your name is inside it, spelled correctly, with more around it. A common word as a name counts for a quarter of this."},{"code":"looks_identical","value":"+0.60","says":"The characters look the same as yours at the size an address is printed."},{"code":"one_character_apart","value":"+0.40","says":"One character differs from your name."},{"code":"two_characters_apart","value":"+0.20","says":"Two characters differ from your name."},{"code":"phishing_word","value":"+0.30","says":"It carries a word such as \"secure\" or \"login\" that makes an address read as official."},{"code":"suffix_in_label","value":"+0.25","says":"Your suffix is pulled into the name, so the address ends the way yours does."},{"code":"abused_suffix","value":"+0.15","says":"The suffix carries a lot of abuse for its size."}]},{"name":"capability","asks":"What can it do today, over the web or over mail?","range":"0.05 to 1","signals":[{"code":"site_address","value":"0.80","says":"It publishes an address record, so it can serve a page."},{"code":"site_answers","value":"0.90","says":"A page on it answers."},{"code":"site_copies_seed","value":"1.00","says":"The page copies yours."},{"code":"reply_capture","value":"0.75","says":"It publishes a mail host, so it can receive a reply somebody meant to send to you."},{"code":"mailbox_provider","value":"0.85","says":"Its mail is carried by a mail provider, so somebody holds a mailbox on it and can answer inside a thread."},{"code":"sending_configured","value":"+0.10","says":"It authorizes a service to send mail as itself."},{"code":"mail_discarded","value":"0.10","says":"Its mail host is the loopback address or the root, so mail sent to it goes nowhere."}]},{"name":"freshness","asks":"Is it new, or did it just change?","range":"0.12 to 1","signals":[{"code":"registered_this_week","value":"1.00","says":"The name was registered in the last seven days."},{"code":"registered_this_month","value":"0.90","says":"The name was registered in the last thirty days."},{"code":"registered_this_quarter","value":"0.75","says":"The name was registered in the last ninety days."},{"code":"registered_this_year","value":"0.60","says":"The name was registered in the last year."},{"code":"registered_years_ago","value":"0.40","says":"The name was registered more than a year ago."},{"code":"registered_long_ago","value":"0.25","says":"Registered over five years ago."},{"code":"change","value":"0.85","says":"It did something: started answering, gained a mail host, moved nameservers, changed registrar or changed registrant. A change overrides the age and then fades over ninety days."},{"code":"dwell","value":"0.50 to 0.85","says":"We have watched it and it has done nothing. The longer we watch a quiet name, the lower it goes."}]},{"name":"reputation","asks":"Who registered it, and who serves it?","range":"0.85 to 1.25","signals":[{"code":"bulk_abuse_pattern","value":"1.25","says":"Three or four of: a registrar we see abuse at, the shared nameservers of a retail service, a hidden registrant, and answering within hours of being registered."},{"code":"cheap_registration","value":"1.10","says":"Two of those four."},{"code":"clean_registrar","value":"0.85","says":"We have seen little abuse at this registrar across the names we watch."}]},{"name":"discounts","asks":"What says a real operator owns it?","range":"0.05 to 1.00","signals":[{"code":"settled_operator","value":"0.50","says":"It has held the same mailbox and the same service verification record for over a year. That is what an ordinary business looks like. Half this reduction until we have watched it for a year ourselves."},{"code":"independently_popular","value":"0.05 to 0.50","says":"People reach it on purpose. A name registered to imitate yours has no traffic of its own."},{"code":"parked","value":"0.30","says":"It shows a holding page that its owner did not write."},{"code":"corporate_registrar","value":"0.40","says":"It is held at a registrar that sells to companies defending brands, not to somebody buying one name."},{"code":"brand_protection_dns","value":"0.60","says":"Its nameservers belong to a brand protection service, so somebody is already defending it."}]}],"events":[{"code":"site_appeared","says":"A site appeared on a name that served nothing."},{"code":"site_answered","says":"It now serves a page that answers."},{"code":"content_matched","says":"The page on it now copies yours."},{"code":"mail_appeared","says":"A mail host appeared, so it can now receive a reply."},{"code":"mailbox_provider_added","says":"A mailbox was set up on it at a mail provider. This is how business email compromise starts."},{"code":"sending_configured","says":"It now authorizes a service to send mail as itself."},{"code":"left_parking","says":"It left the parking service it was held at. Somebody took it off the shelf."},{"code":"changed_hands","says":"Its registrar or its registrant changed."},{"code":"listed","says":"It appeared on a blocklist."}],"floors":[{"code":"blocklisted","value":"85","says":"Somebody already reported it. What it can do today does not matter, and no reduction can bury it."},{"code":"was_weaponized","value":"35","says":"We watched it become able to carry an attack. A site taken down after a campaign is not a name that became safe."},{"code":"registered_this_week","value":"50% of the rest","says":"Bought in the last seven days. An empty name is the normal first state of an attack."},{"code":"registered_this_month","value":"35% of the rest","says":"Bought in the last thirty days."}],"decay":[{"code":"peak","value":"to 0.50 over 90 days","says":"The score falls from the highest reading a name ever had, not from what it is doing this morning."}],"limits":["We do not score a name we cannot see answering. Most generated names are never registered and carry no score at all.","We do not submit a name without a person reading it first, and the review stops a submission going out against a name you own.","We do not treat resemblance as guilt. A competitor with a similar name is a competitor, and the ownership check is there to say so.","We do not hide the reasons. Every score lists the signals that made it, and this page is built from the same values the scorer uses.","We do not read a page yet. Until that lands, a name with an address record is taken as able to serve one, and no higher.","A score is a ranking of what to look at first. It is not a judgment that somebody is guilty."]}