Domain age
<7 days = max weight (fresh phishing kit). 7-30 days = high weight. 30-90 days = medium. >90 days = low (could be legitimate squatting).
Brand Signal · Sub-capability
WHOIS Recency
Domains registered <30 days weigh much more in the score. Classic operational take-downs target young domains — the registrar response window is shorter when the domain is recent.
Capabilities
Automatic WHOIS lookup
Daily polling against registrar APIs. We skip what already passed TLD checks. 7-day cache to reduce cost + rate limiting.
Privacy WHOIS detection
Domains with WHOIS privacy are more suspicious for lookalikes. Additional weight to the score.
Registrar fingerprint
Some registrars (Namecheap, Porkbun) have higher phishing concentration. Stats tracked internally for weighting.
Spike detection
If 10 lookalikes of your brand register in 24h with similar WHOIS recency, critical alert: coordinated campaign being prepped.
Evidence export
WHOIS data exportable for abuse complaints + take-down requests. Timestamp + registrar contact included.