This index compares the number of reports Sender Registry received in the last 7
days against the 7 days before that across every organisation on the network.
A change of more than 5% in either direction is shown as rising or falling; smaller
movements are shown as steady.
This is a deliberately simple, honest first-pass methodology. It does not yet
adjust for seasonality, network growth, or industry baseline volume. We'll say so
plainly if that changes. Below a minimum sample size, we publish nothing rather than
a number that would mostly be noise.
Every object in the registry (a sender, a domain, a campaign) moves through five
stages as independent evidence builds:
UNSEENNothing reported yet.
OBSERVEDOne report exists. A single data point, not yet corroborated.
CORROBORATEDA second, independent organisation has reported the same thing.
NETWORK CONFIRMEDFive or more independent organisations agree.
VERIFIEDTen or more independent organisations, the strongest confidence level.
This is deliberately separate from Risk and Confidence. How much of the network agrees
is a different question from how dangerous something looks, or how certain we are.
How Threat DNA works
Every campaign gets scored across 8 axes: infrastructure, domain patterns, message
templates, link behaviour, attachment patterns, target industries, target roles, and
campaign velocity. All plotted as a fingerprint.
Sender Registry compares every campaign's fingerprint against every other campaign's
using cosine similarity: the same technique used to compare documents by meaning, not
just matching words. A high match (we only ever suggest one above 55% similarity) means
two campaigns that look unrelated on the surface may share real infrastructure, even
under completely different domain names.
How the Intelligence Map works
Senders, domains, URLs, attachments, campaigns, brands and suppliers all become nodes
in a shared relationship graph, built from real evidence: a sender using a domain, a
domain appearing in the same report as another domain, a report belonging to a campaign.
On a phone, we deliberately don't force a giant graph onto a small screen. Instead you
get a focused view: the object you're looking at, and everything directly connected to
it, with a tap to move to any of those connections in turn.
Sender Registry