Risk assessment
What the AI model scores on each copycat page, how the classification bands and risk floor work, and when a page is re-assessed.
Every fetched page is handed to an AI model, together with the brand context — the brand names it matched and the domains you legitimately own — and comes back as a structured assessment. The assessment is what ranks the list, tones the badges and decides whether a finding is shown at all.
What is assessed
The model sees the page snapshot from discovery — the domain, HTTP status, title, description, visible text, outbound links and redirect chain — and the brand context. It returns:
| Field | What it means |
|---|---|
| Name similarity | How confusable the domain name is with your brand and your own domains |
| Impersonation | How far the page passes itself off as your brand — logos, copy, layout, claims |
| Commercial | How commercially it exploits the brand: sales, lead capture, affiliate links, a for-sale page |
| Malicious | Evidence of credential harvesting, malware or scams |
| Site status | Active, Parked, Redirect, Inactive or Unknown |
| Threat types | Zero or more of: brand impersonation, phishing, credential harvesting, malware, scam, counterfeit goods, affiliate abuse, domain for sale, typosquatting, other |
| Overall risk | 0–100 |
| Classification | The risk band, below |
| Confidence | How sure the model is of its own reading |
| Rationale | One or two sentences of reasoning, shown in the detail view and on the finding page |
The four scores are shown as percentages in the detail view's score line and as bars under Why it scored N on the finding page.
Classification bands
| Classification | Overall risk | Badge tone |
|---|---|---|
| High risk | 70 and above | Red |
| Medium risk | 40–69 | Amber |
| Low risk | 20–39 | Blue |
| Benign | Below 20 | Neutral |
The classification is reconciled to the score on the server, so a classification never contradicts the number beside it.
The risk floor
Findings assessed below the risk floor — 50 by default — are kept, so the same page is never assessed twice, but hidden from every view: the list, the gallery, the counts, the dashboard card and the Review Pipeline. Tick Include low risk in the filter bar to see them. The floor is why a weekly search that returns dozens of harmless mentions leaves you a queue of the handful that matter.
When a page is re-assessed
Model calls are spent only on new and changed pages:
- A page whose content fingerprint is unchanged since its last assessment is not re-assessed on a re-check.
- A page whose fingerprint changed is re-assessed, and if its classification rises the finding notifies again (see Notifications).
- An unchanged page is re-assessed anyway once its assessment is older than the re-assessment interval — 30 days by default — so a stale verdict cannot persist indefinitely.
A finding that could be resolved but not assessed — the model was unavailable, or the run ran out of time — is retried on the next run, and stays hidden until it has a model assessment.
The fallback assessment
When the model cannot be used — the OpenRouter key is absent, the daily budget is spent, the call failed, or the domain resolves but serves no page — a deterministic fallback stands in so the finding is still recorded and ranked internally. It scores only on what can be observed without a model: whether the domain serves a page and whether it publishes mail records. It is deliberately conservative — it never produces High risk and never asserts threat types.
A finding carrying the fallback is hidden from your views until the model assesses it — you never see a finding the AI has not looked at. It is re-checked on the next run that can make a model call, and the fallback is replaced by a real assessment as soon as one is available. To see these before then, tick Include low risk in the filter bar; in the detail view a fallback shows an asterisk after the risk score and the note Deterministic fallback.
The Fallback assessment column of an export records which findings currently carry the fallback.
Budgets
Model calls are governed by a per-organisation daily cap and a global daily cap, and by an operator kill switch. When a cap is reached, the remaining pages of the run take the fallback rather than being dropped, and the model is retried the next day. See Runs and limits.