Skip to main content

Domain Reputation

Overview​

The domain reputation view summarizes the signals that influence a domain’s risk score. It is designed for investigations and triage.

On a URL result, the Domain reputation score sits in its own labeled panel with its direction stated: it runs 0–100 and higher is more trustworthy. It is Dralvia's own trust score for the domain, built from our scan history and the domain's age.

It is a separate signal from the risk score on the same page, which rates a single scan and rises with danger. The two are not the same number and can point different ways: a long-trusted domain can still host a risky page on one scan, so a high reputation never overrides the risk verdict for that result.

Reputation is earned per hostname​

Scan history is scoped to the exact hostname that was scanned. A subdomain does not inherit the reputation of the domain it sits under, in either direction.

shop.example.com and example.com are judged on their own scans. A long, clean history on example.com gives shop.example.com nothing, and a bad history on example.com counts against shop.example.com just as little.

This matters because subdomains are not all under the same control. Dangling DNS records, a compromised host, a delegated marketing subdomain and a customer self-service hostname can all sit under a domain with an excellent record. Before 2026-08-17 a hostname that had never been scanned at all could arrive already trusted purely because its parent domain had been scanned clean, which is exactly the position an attacker wants.

Two practical consequences:

  • A new subdomain of a domain you trust starts from a neutral position and is scored on its own evidence. Expect a first scan to look less confident than the parent's.
  • Registration age is still read from the registrable domain, because that is where registration actually lives. Age and scan history are separate signals.

What counts as a clean history​

Trust built from scan history needs the history to be real. Three rules decide whether past scans of a hostname add up to standing:

  • Scans have to be spread out. We measure how long we have been watching a host, not how long ago we first saw it. A batch of scans run in a single sitting counts as one observation, however many rows it produces, and we require observations on at least five different days spanning at least a month.
  • A scan has to have reached the page. If the site did not resolve, refused the connection, or blocked the scanner, that scan is the absence of evidence. It no longer counts toward a clean record. A scan that loaded the page but missed a secondary check, such as a WHOIS or header lookup, is still an ordinary scan and still counts.
  • A bad verdict counts however the scan went. The rule above applies only to earning trust. An Avoid verdict is always counted, so a site cannot clear its record by blocking us.

Registration age is a separate signal, and it belongs to the registrable domain. example.com owns its registration; anything.example.com does not, because whoever controls the domain can create that name in seconds. A domain that is old and presents a valid certificate is treated as established on that basis, but a subdomain of it is not. A subdomain reaches the same standing only through its own watched record.

Fixed on 17 August 2026

Before this, a domain that did not resolve at all could hold a clean history. One example in our own data was scanned 147 times, every scan failing to reach anything, and each failure was recorded as a Safe result. Another was scanned 2,842 times inside three hours on a single day and that read back as three months of clean history.

The practical effect was backwards: making a site hard for the scanner to reach earned it trust. Of the domains holding trusted standing on scan history at the time, more than half had never actually been seen by a scan.

Signals included​

  • Domain age and registrar metadata
  • DNS posture (A, MX, SPF, DMARC)
  • TLS certificate validity and expiry
  • Security header checks (HSTS, CSP, XFO, XCTO)
  • Redirect behavior and final landing page

Where it appears​

  • Phishing/URL scan results
  • EvidencePack (Dralvia's exportable evidence report) attachments
  • Reports and transparency log metadata