Digital risk protection · Validation
An analyst reads it before you do
A threat intelligence feed sends you everything that matched and leaves the sorting to you. Here the sorting is the job. Machine scoring removes the obvious noise, then an analyst confirms each finding, strips out the false positives, works out what it actually is, and attaches a recommended action. What reaches you is a case, not a hit. The exception is out of hours: searching and alerting never stop, so a night-time alert arrives before the review, which follows on the next working day, or sooner if it is urgent.
Under 1% false positives
The question most teams ask first is how many alerts this will add to a queue that is already full. The answer is: few, and checked. Across BlueVoyant’s client base, false positives in the alerts that reach the client are measured at under 1% over a 12-month period.
That number comes from three things working together. Your own domains and assets are allow-listed at onboarding, so known legitimate matches are filtered out. The first 14 days are spent tuning the searches with your feedback. And during analyst hours, every finding passes an analyst before it is delivered; out-of-hours alerts are reviewed afterwards. Redirects to your own site, benign pages that happen to use a similar name and parked domains with nothing on them are sorted out before you see them, not after.
Every alert arrives as an evidence-backed case
| Field | What it tells you |
|---|---|
| Status and category | Where the case stands (for example “needs your action” or “in progress”) and what kind of threat it is: web, social media or app impersonation, compromised credentials, payment cards. |
| Lookalike score | 0 to 100: how closely the domain imitates yours, and which of your keywords it matches. |
| Infrastructure | The resolved IP address, the first DNS activity, the WHOIS record, and whether the domain has a mail (MX) record. |
| Evidence | A screenshot of the page as the analysts captured it. |
| Mitigation | The recommended action, and a button to request the takedown. |
Every case has a unique ID, carried through the alert email, the portal and the takedown, so the history of a threat stays in one place.
What a website’s status means
A suspicious domain can be in many states, and the state decides both how serious it is and whether anything can be removed. Status is assigned from DNS records and active resolution, HTTP status codes, automated probing for phishing features, logo detection and HTML comparison with your own pages.
| Status | Severity | Can it be taken down? |
|---|---|---|
| Active phishing targeting you | High | Yes, on your approval |
| Redirecting to a live phishing site | High | Yes, on your approval; success rates for redirecting domains are lower |
| Active and suspicious: using variations of your brand | Medium | Yes, on your approval |
| Redirecting to your own website, possibly part of an email campaign | Medium | Yes, on your approval; success rates are lower |
| Using your proprietary code or design | Medium | Yes, on your approval |
| Parked, blank, for sale, under construction, unreachable | Medium or low | No; watched, and re-alerted if it comes to life |
| Active but unrelated to your brand | Medium or low | No |
If a domain has an MX (mail) record, the alert says so, and the severity can go up from low to medium: a lookalike set up to handle email is a different risk from one that is not.
When the answer is not on the surface
Some findings need more than a review. Two things go beyond the standard flow.
Investigation requests
You can ask the analysts a question about a finding, a domain, or a campaign you have heard about, through a service request in the portal. The answer comes back in the same case, and there is no limit on the number of requests.
Threat actor engagement
Where it would help to know what is actually being offered, for example whether a credential dump is current or a seller really has what they claim, analysts can engage the actor. They do it only for a specific case you have agreed to in advance, never as a standing permission.
Your feedback makes the next alert better
Findings go to you for validation, and what you tell the analysts feeds back into the searches. When you mark a domain as yours, it is allow-listed. When you confirm that a finding was real, the analysts know that pattern matters to you. The service gets quieter and sharper over the first months, and the reason is this loop.
Where this stops
Under 1% is a rate, not a promise about every alert. You will occasionally see a finding that turns out to be harmless. When you do, mark it, and it is used to tune the searches.
The analysts write in English. Case notes, recommendations and reports are in English. Your Spirity contact can explain any of them in Hungarian or German.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
A feed delivers indicators and leaves triage with you. Here, an analyst decides whether a finding is real, what it is, and what to do about it — before it reaches you during analyst hours, and straight after an out-of-hours alert. You also get the person behind the finding: someone to ask where it came from and whether it is part of something larger.
Tell the analysts in the case and they review it. If it is not a threat, the case is closed and used to tune the searches. If the finding was one of your own assets, it is allow-listed so it does not come back.
Yes. A service request in the portal, or through the API, goes to the analysts or the customer success manager, and the reply comes back in the same case.
The rest of the service
Detection
Passive DNS, criminal chat groups, the dark web, app stores and breach data, ranked before an analyst looks.
Takedown
Three layers of removal, unlimited takedowns, and an 18-hour median for phishing sites.
Reporting
Phishing and credential alerts within 30 minutes of detection, weekly indicator lists, intelligence summaries and monthly KPIs.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.