# How the Risk Score works

> What goes into the Risk Score and the AI Verdict of a domain, why a score changes, and what you can do about it.

Every domain that nebty finds for your brand gets a **Risk Score** from 0 to 10 and an **AI Verdict**. This page explains what goes into them. To learn how to read them on a finding, see [Understand a Risk Score](https://docs.nebty-id.com/guides/understand-a-risk-score/). The red numbers in the screenshots match the numbers in the text.

## One score per brand and domain

The score always describes one domain for one brand. If a domain is relevant to several of your brands, each brand has its own score for it. A score of 0 for one brand does not change the score for another.

![Domain detail page with the Risk Score marked as 1](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/2-risk-score.webp)

## What goes into the score

nebty combines several kinds of evidence:

- **How closely the name imitates your brand.** Typos, swapped or extra characters, added words such as “login” or “support”, or your name under another domain ending. A domain with no meaningful link to your brand does not score at all.
- **Whether the domain is in use.** Does it resolve, receive mail, answer with a website? A registered but unused, offline or broken domain is less of an immediate risk and scores lower than one that serves a page.
- **What the website shows.** nebty takes a screenshot of the site, and an AI model compares it with your own website: logo, colours, layout and other brand assets used to deceive. A second AI check reads the page and judges whether it harms your brand, for example as a fake shop or a phishing page.
- **Independent evidence.** For example, a scam ad that sends people to the domain. Such evidence can bring a domain to your attention even if its name does not look like your brand.
- **Human review.** When the AI is unsure about a screenshot, a nebty analyst reviews the case.

## The bands

| Score | Band | What it means |
| - | - | - |
| 8–10 | High | Confirmed impersonation of your brand on a site that can be reached. Treat it as urgent. |
| 4–7 | Medium | Something deserves a look: a close lookalike that is in use, or a page that reads like a fake shop but does not visibly copy your brand. |
| 1–3 | Low | A related domain with little activity or little evidence so far. It stays on record, and its score can rise. |
| 0 | – | No risk: you marked the domain as yours or as a false positive for this brand, it shows no activity, or it turned out to be unrelated to your brand. The dashboard shows it with the Low Risk label. |

**The high band is reserved for confirmed impersonation.** A domain reaches 8–10 only when the screenshot check confirms that the site presents itself as your brand, and the site can currently be reached. Without that confirmation, a domain stays in the medium band at most, however similar its name is.

## The AI Verdict

The AI Verdict (1) sums up the two AI checks. **Why the model flagged this** (2) shows the AI’s own short explanation.

![Domain detail page with the AI Verdict marked 1 and the box Why the model flagged this marked 2](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/4-ai-verdict.webp)

- **Suspicious:** the screenshot check confirmed that the site impersonates your brand.
- **Needs Review:** something looks wrong, but it is not confirmed. Either the AI was unsure, or the page reads like a fake shop but does not visibly copy your brand.
- **Benign:** the checks found no impersonation of your brand. The site may be unrelated, or a legitimate reseller.
- **Not Yet Assessed:** no AI check has run yet. This is normal for domains that do not serve a website.

A verdict or explanation that is marked as not yet confirmed by a person can be wrong. Check the finding before you act on it.

## Why a score changes

nebty checks domains again and again, and riskier domains more often. A score can therefore change over time:

- It **goes up** when a domain starts to serve a website or receive mail, or when the screenshot check confirms impersonation. A typical jump is from the top of the medium band straight into the high band once impersonation is confirmed.
- It **goes down** when a site goes offline or breaks, or when you mark the domain as yours or as a false positive.
- After a takedown closes, nebty scans the domain again to confirm the result.

The **Scan history** (1) on the domain page shows how the score developed.

![Scan history of a domain marked as 1, with the risk rising over several scans](https://docs.nebty-id.com/images/docs/guides/en/understand-a-risk-score/7-scan-history.webp)

## What you can do

- **This is us:** the domain belongs to you. Its score becomes 0 for this brand, also for its subdomains, and nebty stops flagging it.
- **Feedback > Flag as False Positive:** the domain is not a threat for this brand. Its score becomes 0 for this brand only. A comment that you add is stored, but it does not change the score.
- **Request Takedown:** for genuine impersonation. See [Request a takedown](https://docs.nebty-id.com/guides/request-a-takedown/).
- **Alerts for new results** in **Settings:** nebty emails you, at most once a day, about domains that are newly found with a score above 0 or whose score went up for your brand. A score that stays high does not trigger a new alert.

Marking search results, social media profiles or ads as **Not relevant** hides them in those lists. It does not change the Risk Score of a domain.

## Related

- [Understand a Risk Score](https://docs.nebty-id.com/guides/understand-a-risk-score/)
- [How nebty works](https://docs.nebty-id.com/getting-started/how-nebty-works/)
- [Domain Monitoring](https://docs.nebty-id.com/features/domain-monitoring/)