The Risk Score is an AI-generated score between 1 and 100 assigned to each signal in the URLs & Domains context. The higher the score, the greater the risk the signal represents. It is designed to help analysts prioritize their investigation queue and cut through noise, instead of reviewing hundreds of detections manually, you can focus on the ones that matter most.
Signals scoring above 90 are considered critical — Axur recommends starting your daily triage with these.
Where to find it
The Risk Score appears in two places:
Results table: as the column Risk Score, sortable descending so the highest-risk signals surface immediately.
Signal sideview: when you open a signal, the score appears in the summary section alongside a collapsible Score Breakdown that explains what drove it.
Score Breakdown
The Score Breakdown shows which risk indicators contributed to the score and how much each one weighed. Only indicators that were active for that signal are shown; if an indicator is absent, its contribution was zero.
Each indicator is listed with its name and numeric weight. The weights sum to the total Risk Score. A signal with a single dominant indicator (e.g., Code_threat_label at 38.6) tells a different story than one where the score is distributed across many smaller signals; both warrant investigation, but for different reasons.
Threat Category
The Threat Category field classifies the type of threat the signal represents, as determined by Clair, Axur's AI model. It is one of the following values:
Threat Category | What it means |
Credentials Harvesting | The page is designed to steal login credentials: email, password, or account data |
Payment Scams | The page is designed to fraudulently collect payment information or redirect financial transactions |
Social Engineering | The page manipulates users psychologically: fake urgency, impersonation, or deceptive messaging, without a direct credential or payment form |
Potential Unauthorized Brand Usage | The page uses your brand's visual identity or name without clear authorization, but does not meet the threshold for a higher-severity category and is likely not eligible for takedown |
Malware Technical Abuse | The page contains or distributes malicious code, or its infrastructure indicates technical abuse (e.g., exploit kits, drive-by downloads) |
Benign | The signal was analyzed and does not appear to represent a threat |
Hunting with Risk Score
The Risk Score, its breakdown indicators, and the Threat Category are all queryable fields in Threat Hunting. This section covers the most useful combinations.
Start with the highest-risk signals
The fastest triage query. Surfaces only signal where the model has high confidence of a severe threat.
riskScore>90
Filter by threat type
Focus your investigation on a specific attack pattern. Useful when responding to an active campaign or conducting targeted brand protection work.
threatCategory="Credentials Harvesting"
threatCategory="Payment Scams"
Combine score with a risk indicator that has no direct field equivalent
Some risk indicators. like free hosting infrastructure or punycode encoding, are only accessible via riskIndicator. This lets you surface threat patterns that would not be possible to query otherwise.
riskScore>70 AND riskIndicator="Has Free Hosting Domain"
riskScore>70 AND riskIndicator="Has Punycode"
Combine score with existing brand fields
Cross-reference the Risk Score with your brand's impersonation data for targeted investigation.
riskScore>80 AND impersonatedBrandsHigh="Netflix"
riskScore>90 AND threatCategory="Credentials Harvesting" AND impersonatedBrandsHigh="Netflix"
Other queryable fields
The following fields from the AI analysis are also available in queries and in the signal side view:
Field | What it contains |
threatCategory | Classification of the threat type (see Threat Category section above) |
websiteAnalysis | Free-text AI description of the website's visual content and threat indicators |
htmlCodeAnalysis | Free-text AI analysis of the page's HTML and JavaScript for malicious patterns |
Risk indicator Glossary
The following is a complete list of all risk indicators that can appear in the Score Breakdown and be queried via riskIndicator. They are grouped by category.
Brand signals
Risk indicator | What it means | Example |
Brand Mismatch | The brand shown visually on the page does not match the domain, a strong indicator of impersonation | riskIndicator="Brand Mismatch" |
Brand Mention In Domain | The monitored brand name appears in the domain label (e.g., netflix-login.com) | riskIndicator="Brand Mention In Domain" |
Brand Mention In Subdomain | The monitored brand name appears in a subdomain (e.g., netflix.malicious.com) | riskIndicator="Brand Mention In Subdomain" |
Brand Mention In Path | The monitored brand name appears in the URL path (e.g., malicious.com/netflix/login) | riskIndicator="Brand Mention In Path" |
Has Brand Impersonation High | Clair detected high-confidence brand impersonation on the page | riskIndicator="Has Brand Impersonation High" |
Has Brand Impersonation Medium | Clair detected medium-confidence brand impersonation on the page | riskIndicator="Has Brand Impersonation Medium" |
Has Brand Impersonation Low | Clair detected low-confidence brand impersonation on the page | riskIndicator="Has Brand Impersonation Low" |
Domain infrastructure signals
Risk indicator | What it means | Example |
Domain Age Is Unknown | The domain's registration date could not be determined | riskIndicator="Domain Age Is Unknown" |
Domain Age New | The domain was registered up to 30 days ago, high correlation with malicious activity | riskIndicator="Domain Age New" |
Domain Age Recent | The domain was registered between 30 and 180 days ago, within a range still considered elevated risk | riskIndicator="Domain Age Recent" |
Domain Age Established | The domain has been registered more than 180 days ago | riskIndicator="Domain Age Established" |
Has Free Hosting Domain | The domain is hosted on a free hosting platform commonly abused for malicious content (e.g., netlify.app, vercel.app) | riskIndicator="Has Free Hosting Domain" |
Has Suspicious Tld | The domain uses a top-level domain with high abuse rates (e.g., .online, .shop, .vip) | riskIndicator="Has Suspicious Tld" |
Has Punycode | The domain uses punycode encoding — often used to create visually identical look-alike domains | riskIndicator="Has Punycode" |
Code Threat Label | The HTML and JavaScript analysis identified code patterns associated with malicious behavior | riskIndicator="Code Threat Label" |
Page behavior signals
Risk indicator | What it means | Example |
Has Password Requested Yes | The page contains a field that explicitly requests a password | riskIndicator="Has Password Requested Yes" |
Has Password Requested Possibly | The page may contain a password field — detected with lower confidence | riskIndicator="Has Password Requested Possibly" |
Has Password Requested No | No password request was detected on the page | riskIndicator="Has Password Requested No" |
Has Credential Requested Yes | The page contains a form requesting credentials (email, username, etc.) | riskIndicator="Has Credential Requested Yes" |
Has Credential Requested Possibly | The page may request credentials — detected with lower confidence | riskIndicator="Has Credential Requested Possibly" |
Has Credential Requested No | No credential request was detected on the page | riskIndicator="Has Credential Requested No" |
Has Payment Requested Yes | The page contains a form requesting payment information | riskIndicator="Has Payment Requested Yes" |
Has Payment Requested Possibly | The page may request payment information — detected with lower confidence | riskIndicator="Has Payment Requested Possibly" |
Has Payment Requested No | No payment request was detected on the page | riskIndicator="Has Payment Requested No" |
Threat classification signals
Risk indicator | What it means | Example |
Credentials Harvesting | The overall analysis classifies this signal as a credential theft attempt | riskIndicator="Credentials Harvesting" |
Payment Scams | The overall analysis classifies this signal as a payment fraud attempt | riskIndicator="Payment Scams" |
Social Engineering | The overall analysis classifies this signal as a social engineering attack | riskIndicator="Social Engineering" |
Potential Unauthorized Brand Usage | The overall analysis flags unauthorized use of a brand without meeting higher-severity thresholds | riskIndicator="Potential Unauthorized Brand Usage" |
Malware Technical Abuse | The overall analysis classifies this signal as related to malware or technical infrastructure abuse | riskIndicator="Malware Technical Abuse" |
Benign | The overall analysis did not identify this signal as a threat | riskIndicator="Benign" |
If you have any questions, feel free to reach out at [email protected] 😊