Product

How DomainSpoof works

DomainSpoof links phishing reports and blocklist entries to companies. Each finding shows the source claim and our reasons for the match.

What a company page shows

  • Matching domains with source reports or listings. Grouped by registrable domain. The default window is 30 days; each row labels its date basis.
  • Official domains. Reviewed company domains with published DMARC and SPF policies, where checked.
  • Certificate domains matching the brand. Planned. Name matches will have neutral labels; a match alone cannot establish abuse.
  • History. Separate counts by source report date and first feed observation.

Reading a finding

Each section names who made the claim and when it was recorded:

  1. Source claim: what a source reported or listed, with any dates supplied.
  2. Company match: DomainSpoof’s assessment, with its matching rule and confidence.
  3. DNS and IP checks: dated observations. Shared infrastructure alone cannot establish affiliation.

Being impersonated does not establish a breach or poor security at the targeted company.

Dates and feed coverage

Source reported uses a source-supplied timestamp. Observed in feed uses our last successful observation when no source date exists. Neither establishes an incident or registration date. A record disappearing from a feed does not confirm resolution.

How we match companies (version 1.0)

  1. Source label: a source names a target matching an approved brand alias (confidence 0.9).
  2. Official domain: a hostname under a reviewed company domain is labelled an official asset. Reports remain visible.
  3. Brand name: a distinctive token of at least five characters appears in the hostname (confidence 0.6, possible association). Conflicting matches go to review.

Unknown targets stay unknown.

DNS and IP checks

We record DNS answers with check times and compare returned addresses with approved IP lists. Failed lookups stay unknown. Shared addresses are labelled; listings expire when an address leaves a validated list.

Publication and corrections

We publish fields permitted by each source, with credit. Corrections are free.

Search companies See sources & coverage