Resources / Lookalike monitoring
How the risk score works
Each name that we find has a score from 0 to 100. The score answers one question: how ready is this name for an attack on your customers?
The score does not measure how much the name looks like yours. A name that is one character from yours and does nothing is not a threat yet. A name that is three characters away is a threat if somebody registered it on Tuesday and it can receive a reply.
Most of what we find is never dangerous
We say this clearly, because it decides everything below. A set of variations finds thousands of registered names. Almost all of them are parking pages, or somebody else's business, or a name that a brand registered to protect itself. Most stay that way for ever.
A ranked list of those names is not the product. The product is the day that one of them changes: a site appears on it, somebody configures mail, or it leaves the parking service. So the score does two things. It tells you what a name can do now. And it watches for the day that the answer changes.
What the score is
Five questions. Each answer is a number from 0 to 1, and we multiply the five answers.
score = 100 × deception × capability × freshness × reputation × discounts
We multiply and do not add, for a reason. A name that cannot do anything is not dangerous, even when it looks exactly like yours. A name that is eight years old and has not changed is somebody's business. If we add points and stop the total at 100, the score loses both of these facts. Addition also counts one fact two times when two signals describe it.
How convincing is the name?
How well the name itself can fool somebody. It is the only part that never changes: the name is the name.
deception, from 0.25 to almost 1
| Signal | Effect | What it means |
|---|---|---|
| brand_token | +0.60 | Your name is inside it, spelled correctly, with more around it. A common word as a name counts for a quarter of this. |
| looks_identical | +0.60 | The characters look the same as yours at the size an address is printed. |
| one_character_apart | +0.40 | One character differs from your name. |
| two_characters_apart | +0.20 | Two characters differ from your name. |
| phishing_word | +0.30 | It carries a word such as "secure" or "login" that makes an address read as official. |
| suffix_in_label | +0.25 | Your suffix is pulled into the name, so the address ends the way yours does. |
| abused_suffix | +0.15 | The suffix carries a lot of abuse for its size. |
What can it do today, over the web or over mail?
What the name can do today, over the web or over mail. These are separate channels, and we take the larger. A name with a live site and no mail is fully able to hurt somebody, and the missing mail takes nothing off it.
capability, from 0.05 to 1
| Signal | Effect | What it means |
|---|---|---|
| site_address | 0.80 | It publishes an address record, so it can serve a page. |
| site_answers | 0.90 | A page on it answers. |
| site_copies_seed | 1.00 | The page copies yours. |
| reply_capture | 0.75 | It publishes a mail host, so it can receive a reply somebody meant to send to you. |
| mailbox_provider | 0.85 | Its mail is carried by a mail provider, so somebody holds a mailbox on it and can answer inside a thread. |
| sending_configured | +0.10 | It authorizes a service to send mail as itself. |
| mail_discarded | 0.10 | Its mail host is the loopback address or the root, so mail sent to it goes nowhere. |
Is it new, or did it just change?
Whether the name is new, or has just changed. A name registered this week matters. So does an eight-year-old name that gained a mail host on Tuesday. A quiet name gets quieter the longer we watch it do nothing.
freshness, from 0.12 to 1
| Signal | Effect | What it means |
|---|---|---|
| registered_this_week | 1.00 | The name was registered in the last seven days. |
| registered_this_month | 0.90 | The name was registered in the last thirty days. |
| registered_this_quarter | 0.75 | The name was registered in the last ninety days. |
| registered_this_year | 0.60 | The name was registered in the last year. |
| registered_years_ago | 0.40 | The name was registered more than a year ago. |
| registered_long_ago | 0.25 | Registered over five years ago. |
| change | 0.85 | It did something: started answering, gained a mail host, moved nameservers, changed registrar or changed registrant. A change overrides the age and then fades over ninety days. |
| dwell | 0.50 to 0.85 | We have watched it and it has done nothing. The longer we watch a quiet name, the lower it goes. |
Who registered it, and who serves it?
Who registered it and who serves it. This is the one part that can push a score up as well as down.
reputation, from 0.85 to 1.25
| Signal | Effect | What it means |
|---|---|---|
| bulk_abuse_pattern | 1.25 | Three or four of: a registrar we see abuse at, the shared nameservers of a retail service, a hidden registrant, and answering within hours of being registered. |
| cheap_registration | 1.10 | Two of those four. |
| clean_registrar | 0.85 | We have seen little abuse at this registrar across the names we watch. |
What says a real operator owns it?
What says a real operator owns it, rather than somebody imitating you.
discounts, from 0.05 to 1.00
| Signal | Effect | What it means |
|---|---|---|
| settled_operator | 0.50 | It has held the same mailbox and the same service verification record for over a year. That is what an ordinary business looks like. Half this reduction until we have watched it for a year ourselves. |
| independently_popular | 0.05 to 0.50 | People reach it on purpose. A name registered to imitate yours has no traffic of its own. |
| parked | 0.30 | It shows a holding page that its owner did not write. |
| corporate_registrar | 0.40 | It is held at a registrar that sells to companies defending brands, not to somebody buying one name. |
| brand_protection_dns | 0.60 | Its nameservers belong to a brand protection service, so somebody is already defending it. |
Two names, worked through
These are the two that made us rebuild the model. The old version scored them 52 and 40 — twelve points between a live phishing name and what is probably somebody's company.
Four days old. Live on a bulk registrar, hidden registrant, already reported.
- deception
- 0.82
- your name spelled correctly with a digit after it, on an abused suffix
- capability
- 0.80
- it publishes an address record, so it can serve a page
- freshness
- 1.00
- registered four days ago
- reputation
- 1.10
- a hidden registrant on shared retail nameservers
- discounts
- 1.00
- nothing says a real operator owns it
100 × 0.82 × 0.80 × 1.00 × 1.10 = 72, then held at 85 by the blocklist floor
Eight years old. Stable Google Workspace, a site verification record, no website.
- deception
- 0.82
- one character from your name
- capability
- 0.86
- a mailbox at a mail provider can capture a reply
- freshness
- 0.25
- registered eight years ago and unchanged since
- reputation
- 1.00
- nothing either way
- discounts
- 0.50
- a settled operator: the same mailbox and verification record for years
100 × 0.82 × 0.86 × 0.25 × 1.00 × 0.50 = 9
How the score moves
A score that reads only the present state says the same thing on the first day and on the four hundredth. These are the rules that make it change.
A quiet name sinks on its own
The longer we watch a name do nothing, the lower it goes. After ninety days it keeps two-thirds of its score, and after a year half. Nobody has to dismiss four thousand parked names to make the list usable — they sink. Dismissal is a decision somebody has to make. A decay is not.
A name that is weaponized rises at once
We watch for these changes. Each one is something that the name could not do before and can do now. Each one is a line on your page on the morning that it occurs.
| Event | What happened |
|---|---|
| site_appeared | A site appeared on a name that served nothing. |
| site_answered | It now serves a page that answers. |
| content_matched | The page on it now copies yours. |
| mail_appeared | A mail host appeared, so it can now receive a reply. |
| mailbox_provider_added | A mailbox was set up on it at a mail provider. This is how business email compromise starts. |
| sending_configured | It now authorizes a service to send mail as itself. |
| left_parking | It left the parking service it was held at. Somebody took it off the shelf. |
| changed_hands | Its registrar or its registrant changed. |
| listed | It appeared on a blocklist. |
And it does not fall back quickly
After a campaign, the attacker removes the phishing site, or the host suspends it, or the owner parks the name and waits. A name that was ready for an attack last week and is quiet today is more dangerous than a name that was never ready. So the score does not follow the name down. It falls slowly from the highest reading that the name ever had. The fall stops at half after ninety days. When we saw a name become ready for an attack, its score never goes below 35.
The floors
We apply these last, so that nothing can hide them.
| Floor | Holds at | Why |
|---|---|---|
| blocklisted | 85 | Somebody already reported it. What it can do today does not matter, and no reduction can bury it. |
| was_weaponized | 35 | We watched it become able to carry an attack. A site taken down after a campaign is not a name that became safe. |
| registered_this_week | 50% of the rest | Bought in the last seven days. An empty name is the normal first state of an attack. |
| registered_this_month | 35% of the rest | Bought in the last thirty days. |
How fast we would see it
We read every name under a seed on the same schedule, whatever its score. We do not read the interesting names often and the quiet names rarely. That method spends the checks where a change is likely. But our promise is about the names where a change is unlikely and costly. Nobody else watches a name that has not changed for two years.
What we do not do
- We do not score a name we cannot see answering. Most generated names are never registered and carry no score at all.
- We do not submit a name without a person reading it first, and the review stops a submission going out against a name you own.
- We do not treat resemblance as guilt. A competitor with a similar name is a competitor, and the ownership check is there to say so.
- We do not hide the reasons. Every score lists the signals that made it, and this page is built from the same values the scorer uses.
- We do not read a page yet. Until that lands, a name with an address record is taken as able to serve one, and no higher.
- A score is a ranking of what to look at first. It is not a judgment that somebody is guilty.
This page reads its numbers from the service, at /api/public/risk-model. So the numbers here are the numbers that the scorer uses. Model version 3.
See the scores on the hundred names we watch in the open →
Watch your domain for lookalikes each week for free.