Methodology

Where each badge comes from

• Taken / free — name.com Core API v1 domains:checkAvailability, production, read-only.
• Registrar, nameservers, created, abuse contact — RDAP via the IANA bootstrap. A 404 means not registered and overrides a stale availability answer.
• Already yours / where it lands — DNS-over-HTTPS A/MX/NS lookups plus an HTTP redirect-chain probe (max 5 hops).
• Appears in Google — SerpApi, capped at 10 queries per scan, cached 24h.
• One-line reason — a model call from the fact tuple only. It cannot change band or score.

Rule weights (documented as judgment)

• Keyword class (combosquat): +3
• Mail configured (MX): +3
• Appears in Google: +2
• Homoglyph or omission: +2
• Created within 12 months: +1
• Parked: −1
• Established, likely unrelated: −3, sorts after every other stranger-held card
• Forwards home → band "yours", regardless of score.
• Purchasable → band "free", score from class priors only.

These weights rank attacker economics as a judgment call, not a sourced formula. No source ranks permutation classes by attacker preference (dossier gap).

"Mail configured" excludes placeholder MX

An MX record consisting only of localhost or a host inside a known parking provider's zone (e.g. Sedo) does not count as mail configured, for score or for the takedown notice draft — these are non-functional placeholder values a parking service publishes by default, not evidence a domain can actually receive mail. This is judgment, not a sourced rule: the dossier documents MX as a mail-interception risk signal in general (D-10) but has no entry on parking-provider MX conventions specifically. RFC 7505 null MX (0 .) is excluded the same way, on the RFC's own text.

"Established, likely unrelated"

A stranger-held candidate gets this treatment only if it is a live site with its own page title and its registration is more than 10 years old at scan time. Both conditions are judgment, not sourced facts: a 10-year-old registration and "has a title" are a proxy for "this is probably a dictionary-word or acronym collision that existed long before this scan, not someone squatting this brand" — not proof of unrelatedness. Mail-only, parked, dark, and undetermined candidates are never given this treatment, since none of those show independent, ongoing use of the name the way a titled live site does.

Access code for live scans

Live scans on this public instance need an access code (shared with the event's judges) because every scan spends real registry, search, and model calls; the demo permalinks, replay mode, and this page are open to everyone.

Registrar budget

0 name.com calls used this hour (account cap: 3,000/hour, D-23).

SerpApi searches left this month: 1000 (plan cap 1000).

For the curated demo brand (devnetwork.com) the watch history shown is the committed seed pair; live scans are not added to it.

Not covered

Not covered: look-alikes on someone else's subdomain (brand.example.net), free-hosting pages, non-Latin homographs beyond our table, social handles. A determined attacker uses these too.