Finding domains with a trust score below 40 and recent WHOIS changes
Cybercrime reports filed through Scamwatch and the ACCC keep climbing each year, and Australian organisations across Sydney, Melbourne, and regional centres are feeling the pressure. Phishing emails that impersonate trusted brands remain one of the most common attack vectors, often slipping past basic spam filters by abusing legitimate-looking domains. Spotting those risky senders before they reach staff inboxes has become a board-level concern rather than just an IT one.
Trusted Sender Score offers a free way to investigate domain reputation at a granular level, pulling together email authentication signals, public WHOIS data, and historical scoring. Combining a low trust score with a recent WHOIS change narrows the field considerably, helping security teams and small business owners focus on senders most likely to be involved in spoofing or phishing campaigns.
Setting up your search dashboard
Begin by heading to the Trusted Sender Score homepage and signing in or working as a guest. The main dashboard gives you access to individual domain lookups, bulk checks, and the API documentation. If you would like a guided walkthrough of the interface elements, the dashboard overview lays out the panels and explains how each metric updates over time.
Once inside, locate the search bar at the top of the page. Type in a sender domain you want to investigate, or paste a list of domains into the bulk checker if you have a larger dataset. Australian users running checks during AEST business hours will see fresh results, as the platform refreshes reputation data several times throughout the day.
Applying the trust score threshold
Every domain processed through Trusted Sender Score receives a numerical score reflecting its email authentication health, sending history, and reputation across multiple data sources. A trust score below 40 generally points to weak or missing DKIM and DMARC records, low-quality infrastructure, or associations with previously reported abuse.
When you run a lookup, the score appears prominently on the results page alongside colour-coded indicators. Domains scoring below 40 typically warrant closer manual inspection, particularly if they claim to represent Australian brands but lack verifiable authentication records. Use the filter option on the results table to show only those domains falling under your chosen threshold, then export the filtered list for further analysis.
Detecting recent WHOIS modifications
WHOIS records reveal when a domain was registered, last updated, and which registrar currently hosts it. A sudden change in registrant details, nameservers, or creation date within the past 30 to 90 days is a classic red flag for newly weaponised infrastructure. Cyber criminals often rotate through freshly registered or recently modified domains to extend the lifespan of their phishing kits.
On the results page, scroll to the WHOIS section to view the full registration snapshot. Pay close attention to fields such as "Updated Date," "Registrant Organisation," and "Registrar." If the domain was created or updated within the last three months and shows different contact details from public records, treat it as elevated risk regardless of any other positive signals.
Combining both filters for high-risk targets
The real power comes from layering both conditions. A domain with a low trust score alone might simply be poorly configured, while a domain with a recent WHOIS change could reflect a legitimate rebrand. When both signals appear together, the likelihood of malicious intent rises sharply.
| Signal combination | Risk interpretation | Recommended action |
|---|---|---|
| Trust score below 40 only | Misconfigured or neglected domain | Contact owner, suggest DKIM/DMARC fixes |
| Recent WHOIS change only | Possible rebrand or ownership transfer | Monitor closely for further anomalies |
| Both signals present | High probability of spoofing or phishing | Block at gateway, alert recipients |
| Neither signal present | Likely legitimate sender | Standard monitoring |
Use the bulk upload feature to apply both filters at once across hundreds or thousands of domains. Export the matching subset into a CSV file and feed it into your mail gateway or SIEM tool for downstream automation.
Acting on the combined results
Once you have a refined list of suspicious senders, containment and prevention become the priority. Block the offending domains at your mail server, add them to your internal deny lists, and brief staff on what to watch for. For Australian businesses operating under Notifiable Data Breaches scheme obligations, documenting the rationale behind each block helps demonstrate due diligence if an incident is later reported through cyber.gov.au.
Longer-term, encourage any legitimate senders on your list to fix their authentication setup. The ultimate DMARC project guide walks domain owners through the rollout of SPF, DKIM, and DMARC policies from initial monitoring through to enforcement. Pairing clean authentication with ongoing reputation monitoring on Trusted Sender Score keeps your ecosystem far more resilient against the next wave of impersonation attempts.