Triage a suspicious message and its lookalike domains

The Lab (key 7) has a Suspicious messages section. It combines the scam-signal checker with the domain checks of Signalhouse.

1. Add the message

Open the template Suspicious message triage, or in the Lab open Add a message. Paste the full text, the sender address or number, and optionally the links (copy them with Copy link address — never click them). Press Add message, then Check message.

The result lists the warning signs with their weight: lookalike or homoglyph domains imitating a brand, a brand named while the link goes elsewhere, small “release fees”, urgency, requests for passwords or TANs. The signal score is the tool's, from 0 to 100.

2. Turn the links into targets

The button Add … linked domains as targets adds the registrable domains of the links (and of the sender's e-mail address) to the project, tagged message. Signalhouse never opens these pages.

3. Inspect them

Press Run all. The template's suite fits the question:

• Domain history — registration date and registrar from RDAP. A domain registered a few days ago is a strong sign; Signalhouse adds a finding when it is younger than three months. No registration data at all often means the domain is gone or was never registered.
• Certificate history — when certificates were issued for the name, and for which other names.
• DNS & certificate — whether the domain still resolves. “… does not resolve” is a normal answer for a phishing domain that has already been taken down.

4. Report

The scam checker's advice (in the message result) lists what to do and where to report. Export → Markdown report or Print report gives you a record with dates. Keep personal data out of shared links: the message text is part of the project.