About
About ThreatScope Check
ThreatScope Check is an independent public-interest initiative for inspecting and explaining publicly visible domain trust signals. Its public Check provides free, evidence-led triage of one domain at a time.
The public Check
The public Check examines selected signals for one domain at one point in time. It helps anyone exploring a domain, including governance, risk and technical readers, understand what was observed, what deserves attention and which evidence supports each finding.
It covers four assessment areas: DNS hygiene, email authenticity, web delivery and registration visibility. Certificate history is retained as supporting context, not a separate assessment. A result is a starting point for investigation, not a verdict on whether a domain is safe or trustworthy.
The Provider Catalogue
The Provider Catalogue is a public, versioned reference of documented infrastructure associations. Anyone can browse and cite released provider evidence, or independently reuse a pinned release in another service. Its DNS hosting, inbound mail and SPF associations support interpretation of selected observations without establishing ownership or supplier relationships.
Provider documentation, missing associations and corrections can be submitted for review. A contribution is not a published association: it must satisfy the Catalogue's evidence and release controls before inclusion.
ThreatScope Check Signals
This private workbench lets the steward and authorised collaborators inspect publicly visible domain evidence in greater technical detail, including exact records, sources, unavailable context and point-in-time comparisons. It does not score, monitor or certify domains. Although the evidence comes from public sources, access to the workbench is restricted.
The private Signals Lab is reserved for bounded, question-led experiments. Its current research cycle is closed and the Lab is intentionally idle. Research does not become a public Check feature, Catalogue association or method change simply because it can be implemented; publication requires separate evidence and governance review.
Stewardship and operations
ThreatScope Check is owned and stewarded by Bryan Chetcuti, who holds responsibility for product direction, methodology, public documentation, Provider Catalogue governance and corrections.
The Vigo Group currently provides operational infrastructure and service support under a replaceable arrangement. This operational role does not make ThreatScope Check a Vigo Group product or confer authority over its methodology or findings.
ThreatScope Check uses Cloudflare for hosting and supporting infrastructure, and GitHub for source control, change review and automation. Both are third-party service providers, not sponsors or contributors of in-kind support. Neither organisation has authority over the initiative's methodology, findings or publication decisions.
How to read a result
A Check starts with the decision-facing view, then lets you explore how published signals relate and inspect the evidence behind them.
◎
Start with the conclusion
Read the point-in-time conclusion, priority findings and evidence coverage before diving into technical details.
▤
See what was observed
Explore the four assessment areas. Their icons and colours identify subjects, not a safety rating.
↗
Understand the connections
The How the public signals fit together explanation relates DNS authority, receiving mail, sending policy and DMARC to this domain's returned evidence and limits.
◇
Inspect the supporting evidence
Open a relationship to inspect exact records, signal values, source provenance and any check-specific limitations. Use Snapshot details & export to copy the result or inspect its technical identifiers.
The Check cannot verify internal controls or actual email delivery. If a result is unexpected, report an issue. For an unresolved provider reference, share supporting evidence for review.
Public signals, clear limits
Results are deliberately plain-English, evidence-led and limitation-aware. They help frame better follow-up questions without creating scores, ratings, certification claims or safety guarantees.
ThreatScope Check works from observable public evidence. It does not rely on privileged access, and it should not be treated as a replacement for technical review or formal assurance.
.au and related work
ThreatScope Check is built with .au context in mind, but it is not limited to .au domains. It provides a point-in-time reading for one domain.
Related work through .auDO observes public signals across a curated .au panel over time. ThreatScope Check does not use .auDO data to produce results.
ThreatScope Check surfaces public domain-layer signals. It does not determine whether an organisation is well governed. For a practical governance conversation, the Domain Governance Baseline provides a separate self-assessment around ownership, accountability and visible public signals.
Where to go next
Run a check, read the method and limits, inspect the Provider Catalogue, use Contact & feedback, review the privacy notice, or see the latest public release notes.
