How the Risk Score works
Every domain that nebty finds for your brand gets a Risk Score from 0 to 10 and an AI Verdict. This page explains what goes into them. To learn how to read them on a finding, see Understand a Risk Score. The red numbers in the screenshots match the numbers in the text.
One score per brand and domain
Section titled “One score per brand and domain”The score always describes one domain for one brand. If a domain is relevant to several of your brands, each brand has its own score for it. A score of 0 for one brand does not change the score for another.
What goes into the score
Section titled “What goes into the score”nebty combines several kinds of evidence:
- How closely the name imitates your brand. Typos, swapped or extra characters, added words such as “login” or “support”, or your name under another domain ending. A domain with no meaningful link to your brand does not score at all.
- Whether the domain is in use. Does it resolve, receive mail, answer with a website? A registered but unused, offline or broken domain is less of an immediate risk and scores lower than one that serves a page.
- What the website shows. nebty takes a screenshot of the site, and an AI model compares it with your own website: logo, colours, layout and other brand assets used to deceive. A second AI check reads the page and judges whether it harms your brand, for example as a fake shop or a phishing page.
- Independent evidence. For example, a scam ad that sends people to the domain. Such evidence can bring a domain to your attention even if its name does not look like your brand.
- Human review. When the AI is unsure about a screenshot, a nebty analyst reviews the case.
The bands
Section titled “The bands”| Score | Band | What it means |
|---|---|---|
| 8–10 | High | Confirmed impersonation of your brand on a site that can be reached. Treat it as urgent. |
| 4–7 | Medium | Something deserves a look: a close lookalike that is in use, or a page that reads like a fake shop but does not visibly copy your brand. |
| 1–3 | Low | A related domain with little activity or little evidence so far. It stays on record, and its score can rise. |
| 0 | – | No risk: you marked the domain as yours or as a false positive for this brand, it shows no activity, or it turned out to be unrelated to your brand. The dashboard shows it with the Low Risk label. |
The high band is reserved for confirmed impersonation. A domain reaches 8–10 only when the screenshot check confirms that the site presents itself as your brand, and the site can currently be reached. Without that confirmation, a domain stays in the medium band at most, however similar its name is.
The AI Verdict
Section titled “The AI Verdict”The AI Verdict (1) sums up the two AI checks. Why the model flagged this (2) shows the AI’s own short explanation.
- Suspicious: the screenshot check confirmed that the site impersonates your brand.
- Needs Review: something looks wrong, but it is not confirmed. Either the AI was unsure, or the page reads like a fake shop but does not visibly copy your brand.
- Benign: the checks found no impersonation of your brand. The site may be unrelated, or a legitimate reseller.
- Not Yet Assessed: no AI check has run yet. This is normal for domains that do not serve a website.
A verdict or explanation that is marked as not yet confirmed by a person can be wrong. Check the finding before you act on it.
Why a score changes
Section titled “Why a score changes”nebty checks domains again and again, and riskier domains more often. A score can therefore change over time:
- It goes up when a domain starts to serve a website or receive mail, or when the screenshot check confirms impersonation. A typical jump is from the top of the medium band straight into the high band once impersonation is confirmed.
- It goes down when a site goes offline or breaks, or when you mark the domain as yours or as a false positive.
- After a takedown closes, nebty scans the domain again to confirm the result.
The Scan history (1) on the domain page shows how the score developed.
What you can do
Section titled “What you can do”- This is us: the domain belongs to you. Its score becomes 0 for this brand, also for its subdomains, and nebty stops flagging it.
- Feedback > Flag as False Positive: the domain is not a threat for this brand. Its score becomes 0 for this brand only. A comment that you add is stored, but it does not change the score.
- Request Takedown: for genuine impersonation. See Request a takedown.
- Alerts for new results in Settings: nebty emails you, at most once a day, about domains that are newly found with a score above 0 or whose score went up for your brand. A score that stays high does not trigger a new alert.
Marking search results, social media profiles or ads as Not relevant hides them in those lists. It does not change the Risk Score of a domain.