Incident intelligence designed for safe automation

Datazag delivers phishing intelligence as structured incidents — with confidence, evidence, and reversibility — so platforms can enforce policy without unnecessary risk

Explainable risk factorsDesigned to reduce noiseAPI, feeds & webhooks

Incident Reports

The report covers the full detection lifecycle whether it is a genuine attacker or a false positive. The JSON schema, includes a top level summary, domain and infrastructure context, incident lifecycle and visual evidence links

json
{
  "incident_id": "dz-esp-2026-014892",
  "incident_type": "brand_impersonation",
  "confidence": "high",
  "severity": "critical",
  "status": "confirmed",

  "primary_domain": "secure-acme-login.com",

  "brand": {
    "brand_name": "ACME",
    "brand_id": "acme-001",
    "brand_scope": "customer_registered",
    "brand_match_type": "visual_and_string"
  },

  "first_seen": "2026-01-11T09:14:22Z",
  "last_updated": "2026-01-11T10:02:41Z",

  "recommended_action": "block_and_suspend",
  "delivery_context": "email_platform"
}

alert_id

Allows time based alerts for a single incident to be connected together

primary_domain

Indicates the new domain name found by our monitoring

brand

This is your client brand name found in the incident

brand_scope

customer_registered indicates this brand is opted in by you

brand_match_type

visual identity on offending website supporting audit and explainability

Domain & Infrastructure Context

The context includes domain and hosting details plus SSL certificates and mailing infrastructure including mailbox box provider, SPF and DMARC records.

json
{
  "domain_context": {
    "domain": "secure-acme-login.com",
    "registrar": "Example Registrar",
    "registrar_abuse_email": "abuse@example-registrar.com",
    "domain_age_days": 2,

    "hosting": {
      "asn": "AS13335",
      "provider": "Cloudflare",
      "country": "US"
    },

    "ssl": {
      "issuer": "Let's Encrypt",
      "first_seen": "2026-01-11T09:10:01Z"
    }
  }
}

Incident Lifecycle

Indicates confidence shifts as events unfold and risk scores change.

json
{
  "lifecycle": [
    {
      "stage": "detected",
      "timestamp": "2026-01-11T09:14:22Z",
      "description": "Suspicious domain detected at SSL issuance"
    },
    {
      "stage": "monitoring",
      "timestamp": "2026-01-11T09:29:44Z",
      "description": "No website content detected"
    },
    {
      "stage": "evidence_captured",
      "timestamp": "2026-01-11T09:58:19Z",
      "description": "Website content detected"
    },
    {
      "stage": "confirmed",
      "timestamp": "2026-01-11T10:02:41Z",
      "description": "Brand impersonation confirmed via visual evidence"
    }
  ]
}

Visual Evidence

If it exists, evidence from the domain website is collected to support take down services. We perform a screen capture and identify if the brand logo is present. In addition we collect data from the home page html and, if present, privacy and T&C pages to identify the owner.

json
{
  "evidence": {
    "screenshots": [
      {
        "captured_at": "2026-01-11T09:58:19Z",
        "url": "https://secure-acme-login.com",
        "description": "Fake ACME login page"
      }
    ],
    "brand_visuals_detected": true,
    "evidence_confidence": "high"
  }
}

Security Siganals Variant

As well as phishing alerts, we provide a platform wide variant which are not linked to a particular brand. These are domains that have a common infrastructure link with identified attacks which you can place on a watch list.

json
{
  "incident_id": "dz-signal-2026-033721",
  "incident_type": "security_signal",
  "confidence": "low",
  "severity": "medium",
  "status": "advisory",

  "primary_domain": "acme-secure-auth.net",

  "brand": null,

  "linked_brand_incident": "dz-esp-2026-014892",

  "recommended_action": "increase_scrutiny",
  "delivery_context": "email_platform"
}
{
  "signal_context": {
    "risk_reason": "Infrastructure similarity to confirmed ACME brand impersonation",
    "pattern_matches": [
      "shared_hosting_asn",
      "similar_ssl_certificate",
      "deployment_timing_match"
    ]
  }
}

False Positive Example

In this scenario, the domain looks like brand impersonation when registered, but as the incident matures, it turns out to be legitimate.

json
{
  "incident_id": "dz-esp-2026-019442",
  "incident_type": "brand_impersonation",
  "confidence": "low",
  "severity": "low",
  "status": "suspected",

  "primary_domain": "acme-secure-portal.com",

  "brand": {
    "brand_name": "ACME",
    "brand_id": "acme-001",
    "brand_scope": "customer_registered",
    "brand_match_type": "string_only"
  },

  "first_seen": "2026-01-11T08:22:14Z",
  "last_updated": "2026-01-11T08:22:14Z",

  "recommended_action": "increase_scrutiny",
  "delivery_context": "email_platform"
}
Incident intelligence