Risk Scoring Engine UNIQUE
Deterministic 0-100 score with per-factor explanation. Same inputs → same score (idempotent for tests + audit).
Pillar 6 · Risk-based brand intelligence
Brand Signal
A 0-100 scorer engine combining Levenshtein, DNS posture, WHOIS recency and visual similarity over every lookalike candidate. CISOs see which domains deserve immediate take-down vs. monitor-only.
Capabilities
DNS Posture Signals
Registered + has_mx + has_dmarc + a_record. A domain with valid MX+DMARC is prepping a phishing email — critical alert.
WHOIS Recency
Domains registered <30 days weigh more in the score. Operational takedowns target young domains — historical data.
Visual Similarity (V1.1) V1.1
Perceptual hash + dHash + favicon + title fingerprint vs. cached official snapshot. Catches them even when they change the domain.
Reproducible + auditable
No LLMs, no external network calls in the scorer. Trivially reproducible tests, idempotent rescore. Audit-log compatible.
Automatic prioritization
60+ score → high priority (CISO must see). 30-60 → medium (monitor). <30 → low (not targeted phishing). No false-positive alerts.