Multi-signal check
Cross-check of registered + has_mx + has_dmarc + a_record + has_https. More active signals = more likely operational phishing kit.
Brand Signal · Sub-capability
DNS Posture Signals
How many active DNS signals a lookalike candidate has. A domain with valid MX + DMARC + A record is prepping a phishing email — it's not a parking domain. Weighs heavily in the score.
Capabilities
Critical MX check
Domain with MX configured = capable of receiving email = prepping inbound phishing (collecting submitted credentials). High weight in score.
DMARC posture
If the lookalike has valid DMARC, it is playing professional. Less likely fast takedown. Score goes up.
A record + HTTPS
Active server with HTTPS cert = phishing landing set up. Without it = maybe just passive squatting.
Detected changes
If a candidate goes from 0 signals to 4 in 24h, it is a campaign being prepped. Priority alert + automatic rescore.
Signal history
We track which signals the candidate activated and when. Useful for abuse complaints + take-down justification.