Domain Summary

The domain name.

ISO 8601 timestamp of when the authenticated user last submitted this domain for analysis. Each user sees their own analysis date, not a global timestamp.

Analysis status: pending, processing, or completed.

Total entity counts: emails, people, files, subdomains, usernames, related_domains.

Security indicators including spoofable_emails, leaked_emails, active_subdomains, takeover_vulnerable, passwords_exposed, people_with_emails, people_in_files, critical_vulnerabilities, high_vulnerabilities, login_pages_count, usernames_in_files, avg_services_emails, avg_services_usernames, email_auth, breach_analytics, and posture.

posture is the External Posture index — a qualitative per-topic map keyed by stable topic id. Each value is one of good, watch, at-risk, or not-assessed. Topics are derived from existing aggregates and mapped to NIS2 Article 21 and CIS Controls v8 references:

• email-auth — DMARC + SPF posture (NIS2 21(2)(h), CIS C9).
• vulnerability — known CVEs on detected subdomain tech (NIS2 21(2)(e), CIS C7). not-assessed until detect_subdomain_technologies has run.
• credential-exposure — breached emails / exposed passwords / recent breach activity (NIS2 21(2)(j), CIS C5).
• attack-surface — public surface size relative to the requesting user's reported organisation size; flags internal subdomains with login pages (NIS2 21(2)(a), CIS C1).
• shadow-it — third-party SaaS sprawl inferred from avg_services_emails (NIS2 21(2)(f), CIS C2). not-assessed until find_registered_sites_priority has run.
• high-profile — privileged / executive people with breached linked emails (NIS2 21(2)(g), CIS C14).
• crypto-dns — TLS grade plus DNSSEC and registrar-lock signals from WHOIS (NIS2 21(2)(h), ENS mp.com.*).

The index reflects only what is externally observable via OSINT. It is not a NIS2 / ENS compliance audit and does not measure internal controls.

email_auth is the structured email-authentication posture (DMARC + SPF) for the domain's canonical email zone. null until the spoofability check has run. When present:

• spoofing_protection: tri-state — protected (DMARC p=reject enforced + SPF -all), partial (some controls in place but enforcement is incomplete), spoofable (DMARC p=none/missing with weak SPF), or unknown (not yet computed).
• reasons: human-readable strings explaining each detected weakness; empty when fully protected.
• dmarc: parsed DMARC policy (reject/quarantine/none/missing), pct percentage, the raw _dmarc.<domain> TXT record, and checked_at timestamp.
• spf: parsed SPF policy (hard_fail/soft_fail/neutral/permissive/missing), the all-mechanism qualifier, the raw apex TXT record, and checked_at timestamp.

breach_analytics is the aggregated third-party breach exposure across the domain's discovered emails. Always present (never null); a domain with no breach signals yet returns all counts at zero. Fields:

• total_breaches (number): distinct breaches affecting any of the domain's emails.
• affected_emails (number): distinct emails with at least one breach link (any time).
• recent_affected_emails (number): distinct emails affected by breaches whose breach_date falls inside the recent window (recent_window_years).
• total_emails (number): total emails discovered for the domain.
• recent_pct (number, 0–100): share of total_breaches whose breach_date falls inside the last recent_window_years.
• recent_window_years (number): width of the recent window in years (default 2).
• yearly_counts (array of { year, count }): distinct breaches per year for the timeline window (default last 10 calendar years ending in the current year), ascending by year. The series is densified server-side — every year in the window appears with count: 0 if no breaches landed that year, so the frontend sparkline draws a continuous line.
• latest_breaches (array, max 3): most recent breaches by breach_date (descending; rows with a null breach_date sink to the bottom). Each entry: { name, title, breach_date, affected_count, pwn_count }.

Aggregated risk score from 0 to 100. null if not yet calculated.

Risk classification: info, low, medium, high, or critical. null if not yet calculated.

TLS/SSL security grade (A+, A, A-, B, C, D, E, F, T, M). null when not yet scanned, when HTTPS is not available, or when the TLS scanner could not complete the assessment. Use tls_scanned to check whether a scan was attempted.

Whether a TLS assessment has been attempted. A null grade with tls_scanned: true indicates the domain either does not serve HTTPS or the scanner could not complete the assessment.

Dashboard highlights: most_exposed_people (excludes people with unlikely affiliation), interesting_subdomains, interesting_files.

WHOIS and DNS data. Top-level keys: registrar, creation_date, expiration_date (extracted from whois_data for quick access), plus the full raw whois_data and dns_records objects for clients that need every record type (NS, MX, TXT, SPF, DMARC, DNSSEC flags, etc.). Any field that is absent in the upstream WHOIS / DNS response is null.

Whether all analysis phases (including deep enrichment) have completed.

Progress indicator with phase and percentage. Only present when status is processing.

Technology stack summary with categories (name + count + percentage).

Organization name provided when the domain was first analyzed.