Calculator inputs
Formula used
The calculator converts each signal into a subscore from 0 to 100, where higher values indicate greater risk. The overall score is a weighted average:
- Domain age: exponential decay, newest domains score highest risk.
- Blacklist and reports: scaled counts with caps to avoid runaway scores.
- Email posture: combined SPF, DKIM, DMARC, and MX presence.
- Impersonation: typo distance, brand terms, and lookalike characters.
How to use this calculator
- Collect signals from DNS, certificate checks, and reputation sources.
- Enter values honestly, using your latest incident context.
- Press Calculate Risk to score the domain immediately.
- Review top drivers, then prioritize actions for mitigation.
- Download CSV or PDF to share evidence with stakeholders.
Example data table
| Domain | Age (days) | Blacklist hits | Phishing reports | Email posture | Impersonation | Score | Level |
|---|---|---|---|---|---|---|---|
| trusted-payments.example | 2200 | 0 | 0 | Strong | Low | 18.6 | Low |
| login-secure-update.example | 12 | 2 | 1 | Weak | High | 76.8 | High |
| brand-support-help.example | 45 | 1 | 0 | Medium | Medium | 54.2 | Moderate |
| invoice-viewer.example | 5 | 6 | 3 | Weak | High | 91.4 | Critical |
| news-portal.example | 700 | 0 | 0 | Medium | Low | 27.9 | Low |
Risk signals covered by the model
The calculator consolidates eleven fraud indicators into a 0–100 risk score. Each indicator becomes a subscore where 0 represents low concern and 100 represents elevated concern. Domain age, blacklist exposure, phishing reports, impersonation traits, email posture, and behavioral signals are included. Input caps are applied to stabilize outcomes, including 50 maximum blacklist hits and 50 maximum phishing reports. This prevents extreme counts from masking other signals overall.
Weights and decision thresholds
Signals are fused using a weighted average where the weights sum to 1.00. High-impact drivers include blacklist exposure (0.12), phishing reports (0.12), and email authentication (0.12). Domain age contributes 0.14 because newly registered domains are disproportionately used for short-lived campaigns. Risk levels follow fixed thresholds: Low below 35, Moderate from 35 to 59.9, High from 60 to 79.9, and Critical at 80 or higher.
Age decay and impersonation detection
Domain age is modeled with exponential decay: ageRisk = 100 × e^(−0.55 × years). At 0 years, ageRisk is near 100; at 1 year it drops near 57; at 2 years it approaches 32. Impersonation scoring combines typosquat distance, brand keyword usage, and homoglyph presence. Typosquat distance uses a saturating curve to emphasize near-miss domains. Homoglyph toggles raise risk because lookalike characters are frequently used in credential capture and invoice fraud.
Reputation and email control posture
Reputation is represented by blacklist hits and phishing reports scaled to 0–100 subscores. Email posture is computed from SPF, DKIM, DMARC, and MX presence because domain fraud often begins with spoofed mail. DMARC “reject” produces the lowest risk subscore, while missing DMARC yields the highest. If MX records exist, stronger policies are expected. WHOIS privacy increases uncertainty, so the model applies a moderate penalty rather than treating privacy as definitive evidence of abuse.
Operational usage and exportable evidence
Use the score as a triage tool, then validate the top drivers with direct evidence. For example, high blacklist contribution should be verified across multiple providers and time windows. High impersonation contribution should trigger brand monitoring and user-facing warnings. The CSV export preserves subscores, weights, and contributions for audit trails. The PDF report provides a concise summary for incident tickets. Re-score after remediation, such as enabling DNSSEC, tightening DMARC, or removing redirects.
FAQs
1) What does a 0–100 score mean?
It is a relative risk estimate, not a certainty. Higher scores indicate more fraud-aligned signals across age, reputation, impersonation, email posture, and behavior. Use it to prioritize investigation and controls.
2) Why do new domains score higher?
Many campaigns register disposable domains for short lifetimes. The age signal uses exponential decay, so very young domains carry more weight early, then decline as longevity and stability increase.
3) Does WHOIS privacy always indicate fraud?
No. Privacy can be legitimate for individuals and small organizations. The model applies a modest uncertainty penalty rather than marking it as malicious, so other signals still drive the final result.
4) Which email settings reduce risk most?
Aligned DKIM, strict SPF, and a DMARC “reject” policy reduce spoof acceptance. If the domain has MX records, these controls matter more because mail delivery capability increases the attack surface.
5) How should I choose TLD and hosting risk?
Use your internal abuse rates, threat intelligence feeds, and enforcement context. Rate 1 as low concern and 5 as elevated concern. Revisit ratings periodically because abuse patterns shift over time.
6) Can I use the exports for compliance evidence?
Yes. CSV captures the full breakdown for audit-friendly records, while PDF summarizes the outcome and top drivers for tickets and stakeholder updates. Store exports alongside your supporting checks and timestamps.