Commit `6e273c2676`

6e273c2676ce29cef057d117e4427e031886e743

parent: d624802338

Unsigned

cmc <hello@cleberg.net> · 2026-07-17 15:39 UTC

v4.7.0: Add domain reputation/blocklist data source

- New DomainReputationResult model (status: clean/listed/unknown, listed
  sources, checked-at) and a `reputation(domain:)` method on ExternalDataService,
  mirroring the existing pluggable-URL enrichment pattern (ownership history,
  DNS history, extended subdomains, pricing). With no endpoint configured
  (the default; DomainDig ships no bundled third-party reputation dependency)
  it resolves to unavailable rather than "clean".
- New .reputation FeatureCapability/DataCapability, gated Pro+ like domainPricing.
- Threaded reputation/reputationError through LookupSnapshot and HistoryEntry
  (backward-compatible decode) so results persist with history entries.
- Auto-fetched in performLookup alongside pricing; surfaced as a "Reputation"
  info row, folded into DomainInsightEngine's risk score/factors and top-level
  insights (a listed domain raises risk score and adds a factor/insight), and
  exported in text, CSV, and JSON report output.
- Reputation-driven risk changes ride the existing change-severity pipeline, so
  a listed status flip is visible to monitoring the same way any other risk
  delta is, without bespoke monitoring wiring.

Layout: unified · split

DomainDig/DataAccessService.swift +2

             return FeatureAccessService.hasAccess(to: .extendedSubdomains)
         case .domainPricing:
             return FeatureAccessService.hasAccess(to: .domainPricing)
+        case .reputation:
+            return FeatureAccessService.hasAccess(to: .reputation)
         }
     }
 }

DomainDig/DomainInsightEngine.swift +16

	@@ -303,6 +303,19 @@ enum DomainInsightEngine {
303	}	303	}
304	}	304	}
305		305
		306	if let reputation = snapshot.reputation {
		307	switch reputation.status {
		308	case .listed:
		309	score += 25
		310	let sourceList = reputation.listedSources.isEmpty ? "" : " (\(reputation.listedSources.joined(separator: ", ")))"
		311	factors.append(.init(description: "Domain is flagged by a configured reputation source\(sourceList)", impact: .negative))
		312	case .clean:
		313	factors.append(.init(description: "Domain is clean against the configured reputation source", impact: .positive))
		314	case .unknown:
		315	break
		316	}
		317	}
		318
306	let clampedScore = min(max(score, 0), 100)	319	let clampedScore = min(max(score, 0), 100)
307	let level: RiskLevel	320	let level: RiskLevel
308	switch clampedScore {	321	switch clampedScore {
	@@ -327,6 +340,9 @@ enum DomainInsightEngine {
327	) -> [String] {	340	) -> [String] {
328	var items: [String] = []	341	var items: [String] = []
329		342
		343	if snapshot.reputation?.status == .listed {
		344	items.append("Domain is flagged by a configured reputation source")
		345	}
330	if let group = subdomainGroups.first(where: { $0.label == "staging" \|\| $0.label == "dev" }) {	346	if let group = subdomainGroups.first(where: { $0.label == "staging" \|\| $0.label == "dev" }) {
331	items.append("Multiple \(group.label) subdomains suggest non-production environments are exposed")	347	items.append("Multiple \(group.label) subdomains suggest non-production environments are exposed")
332	}	348	}

DomainDig/DomainMonitoringService.swift +4

             extendedSubdomains: snapshot.extendedSubdomains,
             dnsHistory: snapshot.dnsHistory,
             domainPricing: snapshot.domainPricing,
+            reputation: snapshot.reputation,
             portScanResults: snapshot.portScanResults,
             hstsPreloaded: snapshot.hstsPreloaded,
             availabilityResult: snapshot.availabilityResult,
             extendedSubdomainsError: snapshot.extendedSubdomainsError,
             dnsHistoryError: snapshot.dnsHistoryError,
             domainPricingError: snapshot.domainPricingError,
+            reputationError: snapshot.reputationError,
             portScanError: snapshot.portScanError
         )
             dnsHistoryError: previousSnapshot.dnsHistoryError,
             domainPricing: previousSnapshot.domainPricing,
             domainPricingError: previousSnapshot.domainPricingError,
+            reputation: previousSnapshot.reputation,
+            reputationError: previousSnapshot.reputationError,
             portScanResults: previousSnapshot.portScanResults,
             portScanError: previousSnapshot.portScanError,
             changeSummary: previousSnapshot.changeSummary,

DomainDig/DomainViewModel.swift +51

     var domainPricing: DomainPricingInsight?
     var domainPricingLoading = false
     var domainPricingError: String?
+    var reputation: DomainReputationResult?
+    var reputationLoading = false
+    var reputationError: String?
     var usageCredits: [UsageCreditFeature: UsageCreditStatus] = DomainViewModel.defaultUsageCredits()
     var portScanResults: [PortScanResult] = []
             dnsHistoryError: dnsHistoryError,
             domainPricing: domainPricing,
             domainPricingError: domainPricingError,
+            reputation: reputation,
+            reputationError: reputationError,
             portScanResults: allPortScanResults,
             portScanError: combinedPortScanError,
             changeSummary: currentChangeSummary,
             await refreshDomainPricing(for: snapshot.domain, persistAfterFetch: false)
         }
+        if DataAccessService.hasAccess(to: .reputation), reputation == nil {
+            DomainDebugLog.debug("DomainViewModel.performLookup loadingReputation domain=\(domain)")
+            await refreshReputation(for: snapshot.domain, persistAfterFetch: false)
+        }
         guard snapshot.statusMessage == nil else {
             return history.first(where: { $0.id == snapshot.historyEntryID })
         }
             dnsHistoryError: previousSnapshot.dnsHistoryError,
             domainPricing: previousSnapshot.domainPricing,
             domainPricingError: previousSnapshot.domainPricingError,
+            reputation: previousSnapshot.reputation,
+            reputationError: previousSnapshot.reputationError,
             portScanResults: previousSnapshot.portScanResults,
             portScanError: previousSnapshot.portScanError,
             changeSummary: previousSnapshot.changeSummary,
             extendedSubdomains: snapshot.extendedSubdomains,
             dnsHistory: snapshot.dnsHistory,
             domainPricing: snapshot.domainPricing,
+            reputation: snapshot.reputation,
             portScanResults: snapshot.portScanResults,
             hstsPreloaded: snapshot.hstsPreloaded,
             availabilityResult: snapshot.availabilityResult,
             extendedSubdomainsError: snapshot.extendedSubdomainsError,
             dnsHistoryError: snapshot.dnsHistoryError,
             domainPricingError: snapshot.domainPricingError,
+            reputationError: snapshot.reputationError,
             portScanError: snapshot.portScanError
         )
             dnsHistoryError: nil,
             domainPricing: nil,
             domainPricingError: nil,
+            reputation: nil,
+            reputationError: nil,
             portScanResults: [],
             portScanError: nil,
             changeSummary: trackedDomain.lastChangeSummary,
                 rows.append(InfoRowViewData(label: "Auction", value: auctionSignal, tone: .secondary))
             }
         }
+        if let reputation = snapshot.reputation {
+            let tone: ResultTone
+            switch reputation.status {
+            case .clean: tone = .success
+            case .listed: tone = .failure
+            case .unknown: tone = .secondary
+            }
+            let value = reputation.status == .listed && !reputation.listedSources.isEmpty
+                ? "\(reputation.status.title) (\(reputation.listedSources.joined(separator: ", ")))"
+                : reputation.status.title
+            rows.append(InfoRowViewData(label: "Reputation", value: value, tone: tone))
+        }
         if let certificateStatus = certificateBadgeLabel(from: snapshot) {
             rows.insert(
                 InfoRowViewData(
         }
     }
+    private func refreshReputation(for domain: String, persistAfterFetch: Bool) async {
+        reputationLoading = true
+        let outcome = await ExternalDataService.shared.reputation(domain: domain)
+        switch outcome.value {
+        case let .success(result):
+            reputation = result
+            reputationError = nil
+        case let .empty(message):
+            reputation = nil
+            reputationError = conciseExternalMessage(message, fallback: "Reputation check unavailable")
+        case let .error(message):
+            reputation = nil
+            reputationError = conciseExternalMessage(message, fallback: "Reputation check unavailable")
+        }
+        reputationLoading = false
+        if persistAfterFetch {
+            _ = saveHistoryEntry(replaceLatest: true)
+        }
+    }
     private func conciseExternalMessage(_ message: String, fallback: String) -> String {
         let trimmed = message.trimmingCharacters(in: .whitespacesAndNewlines)
         if trimmed.isEmpty {

DomainDig/ExternalDataService.swift +66 −1

	@@ -8,12 +8,14 @@ actor ExternalDataService {
8	case dnsHistory(String)	8	case dnsHistory(String)
9	case extendedSubdomains(String)	9	case extendedSubdomains(String)
10	case pricing(String)	10	case pricing(String)
		11	case reputation(String)
11	}	12	}
12		13
13	private enum RateLimitBucket: Hashable {	14	private enum RateLimitBucket: Hashable {
14	case history	15	case history
15	case subdomains	16	case subdomains
16	case pricing	17	case pricing
		18	case reputation
17		19
18	var minimumSpacing: TimeInterval {	20	var minimumSpacing: TimeInterval {
19	switch self {	21	switch self {
	@@ -23,6 +25,8 @@ actor ExternalDataService {
23	return 1.5	25	return 1.5
24	case .pricing:	26	case .pricing:
25	return 1.0	27	return 1.0
		28	case .reputation:
		29	return 1.0
26	}	30	}
27	}	31	}
28	}	32	}
	@@ -32,6 +36,7 @@ actor ExternalDataService {
32	case dnsHistory(ServiceResult<[DNSHistoryEvent]>)	36	case dnsHistory(ServiceResult<[DNSHistoryEvent]>)
33	case extendedSubdomains(ServiceResult<[DiscoveredSubdomain]>)	37	case extendedSubdomains(ServiceResult<[DiscoveredSubdomain]>)
34	case pricing(ServiceResult<DomainPricingInsight>)	38	case pricing(ServiceResult<DomainPricingInsight>)
		39	case reputation(ServiceResult<DomainReputationResult>)
35	}	40	}
36		41
37	private struct CacheEntry {	42	private struct CacheEntry {
	@@ -44,6 +49,7 @@ actor ExternalDataService {
44	let dnsHistoryURL: String?	49	let dnsHistoryURL: String?
45	let extendedSubdomainsURL: String?	50	let extendedSubdomainsURL: String?
46	let pricingURL: String?	51	let pricingURL: String?
		52	let reputationURL: String?
47	}	53	}
48		54
49	private let ttl: TimeInterval = 900	55	private let ttl: TimeInterval = 900
	@@ -161,6 +167,25 @@ actor ExternalDataService {
161	)	167	)
162	}	168	}
163		169
		170	/// Checks a domain against a configured blocklist/reputation endpoint. With
		171	/// no endpoint configured (the default, since DomainDig ships no bundled
		172	/// third-party reputation dependency) this resolves to `.empty` and callers
		173	/// treat the result as unavailable rather than "clean".
		174	func reputation(domain: String) async -> CachedLookupResult<ServiceResult<DomainReputationResult>> {
		175	let normalizedDomain = Self.normalize(domain)
		176	return await execute(
		177	key: .reputation(normalizedDomain),
		178	rateLimitBucket: .reputation,
		179	extract: { payload in
		180	guard case let .reputation(result) = payload else { return nil }
		181	return result
		182	},
		183	operation: { [configuration = configuration()] in
		184	.reputation(await self.fetchReputation(domain: normalizedDomain, configuration: configuration))
		185	}
		186	)
		187	}
		188
164	private func execute<T>(	189	private func execute<T>(
165	key: RequestKey,	190	key: RequestKey,
166	rateLimitBucket: RateLimitBucket,	191	rateLimitBucket: RateLimitBucket,
	@@ -213,7 +238,9 @@ actor ExternalDataService {
213	extendedSubdomainsURL: defaults.string(forKey: "externalData.extendedSubdomainsURL")	238	extendedSubdomainsURL: defaults.string(forKey: "externalData.extendedSubdomainsURL")
214	?? Bundle.main.object(forInfoDictionaryKey: "ExternalExtendedSubdomainsURL") as? String,	239	?? Bundle.main.object(forInfoDictionaryKey: "ExternalExtendedSubdomainsURL") as? String,
215	pricingURL: defaults.string(forKey: "externalData.pricingURL")	240	pricingURL: defaults.string(forKey: "externalData.pricingURL")
216	?? Bundle.main.object(forInfoDictionaryKey: "ExternalPricingURL") as? String	241	?? Bundle.main.object(forInfoDictionaryKey: "ExternalPricingURL") as? String,
		242	reputationURL: defaults.string(forKey: "externalData.reputationURL")
		243	?? Bundle.main.object(forInfoDictionaryKey: "ExternalReputationURL") as? String
217	)	244	)
218	}	245	}
219		246
	@@ -290,6 +317,28 @@ actor ExternalDataService {
290	}	317	}
291	}	318	}
292		319
		320	private func fetchReputation(
		321	domain: String,
		322	configuration: Configuration
		323	) async -> ServiceResult<DomainReputationResult> {
		324	guard let template = configuration.reputationURL,
		325	let url = Self.url(from: template, domain: domain) else {
		326	return .empty("No reputation source configured")
		327	}
		328
		329	switch await requestData(url: url) {
		330	case let .success(data):
		331	guard let reputation = parseReputation(from: data) else {
		332	return .error("Invalid external response")
		333	}
		334	return .success(reputation)
		335	case let .empty(message):
		336	return .empty(message)
		337	case let .error(message):
		338	return .error(message)
		339	}
		340	}
		341
293	private func requestData(url: URL) async -> ServiceResult<Data> {	342	private func requestData(url: URL) async -> ServiceResult<Data> {
294	for attempt in 0..<2 {	343	for attempt in 0..<2 {
295	do {	344	do {
	@@ -403,6 +452,22 @@ actor ExternalDataService {
403	)	452	)
404	}	453	}
405		454
		455	private func parseReputation(from data: Data) -> DomainReputationResult? {
		456	guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
		457	return nil
		458	}
		459
		460	let listedSources = json["listed_sources"] as? [String] ?? []
		461	let status: DomainReputationStatus
		462	if let statusString = json["status"] as? String, let parsed = DomainReputationStatus(rawValue: statusString) {
		463	status = parsed
		464	} else {
		465	status = listedSources.isEmpty ? .clean : .listed
		466	}
		467
		468	return DomainReputationResult(status: status, listedSources: listedSources, checkedAt: Date())
		469	}
		470
406	private static func localOwnershipHistory(	471	private static func localOwnershipHistory(
407	domain: String,	472	domain: String,
408	currentOwnership: DomainOwnership?,	473	currentOwnership: DomainOwnership?,

DomainDig/FeatureAccessService.swift +5 −2

     case dnsHistory
     case extendedSubdomains
     case domainPricing
+    case reputation
     var id: String { rawValue }
             return "Extended subdomains"
         case .domainPricing:
             return "Domain pricing"
+        case .reputation:
+            return "Domain reputation"
         }
     }
 }
         switch capability {
         case .workflows, .batchOperations, .automatedMonitoring, .localAlerts, .advancedExports:
             return "Available in Pro"
-        case .ownershipHistory, .dnsHistory, .extendedSubdomains, .domainPricing:
+        case .ownershipHistory, .dnsHistory, .extendedSubdomains, .domainPricing, .reputation:
             return "Available in Pro+"
         case .limitedTracking:
             return "Tracking is limited on Free"
     static func upgradePrompt(for capability: FeatureCapability) -> UpgradePromptContext {
         let title: String
         switch capability {
-        case .ownershipHistory, .dnsHistory, .extendedSubdomains, .domainPricing:
+        case .ownershipHistory, .dnsHistory, .extendedSubdomains, .domainPricing, .reputation:
             title = "Available in Pro+"
         default:
             title = "Available in Pro"

DomainDig/Models.swift +32 −1

     case dnsHistory
     case extendedSubdomains
     case domainPricing
+    case reputation
 }
 enum UsageCreditFeature: String, Codable, CaseIterable, Identifiable, Sendable {
     let collectedAt: Date
 }
+enum DomainReputationStatus: String, Codable, Sendable {
+    case clean
+    case listed
+    case unknown
+    var title: String {
+        switch self {
+        case .clean:
+            return "Clean"
+        case .listed:
+            return "Listed"
+        case .unknown:
+            return "Unknown"
+        }
+    }
+}
+struct DomainReputationResult: Codable, Equatable, Sendable {
+    let status: DomainReputationStatus
+    let listedSources: [String]
+    let checkedAt: Date
+}
 enum HistoryDateFilter: String, CaseIterable, Identifiable {
     case today
     case last7Days
     var extendedSubdomains: [DiscoveredSubdomain]
     var dnsHistory: [DNSHistoryEvent]
     var domainPricing: DomainPricingInsight?
+    var reputation: DomainReputationResult?
     var portScanResults: [PortScanResult]
     var hstsPreloaded: Bool?
     var availabilityResult: DomainAvailabilityResult?
     var extendedSubdomainsError: String?
     var dnsHistoryError: String?
     var domainPricingError: String?
+    var reputationError: String?
     var portScanError: String?
     init(domain: String, timestamp: Date, trackedDomainID: UUID? = nil, note: String? = nil, dnsSections: [DNSSection],
          ptrRecord: String? = nil, redirectChain: [RedirectHop] = [], subdomains: [DiscoveredSubdomain] = [],
          extendedSubdomains: [DiscoveredSubdomain] = [], dnsHistory: [DNSHistoryEvent] = [],
          domainPricing: DomainPricingInsight? = nil,
+         reputation: DomainReputationResult? = nil,
          portScanResults: [PortScanResult] = [],
          hstsPreloaded: Bool? = nil, availabilityResult: DomainAvailabilityResult? = nil,
          suggestions: [DomainSuggestionResult] = [], appVersion: String = "2.7.0",
          emailSecurityError: String? = nil, ownershipError: String? = nil, ownershipHistoryError: String? = nil,
          ptrError: String? = nil, redirectChainError: String? = nil, subdomainsError: String? = nil,
          extendedSubdomainsError: String? = nil, dnsHistoryError: String? = nil,
-         domainPricingError: String? = nil, portScanError: String? = nil) {
+         domainPricingError: String? = nil, reputationError: String? = nil, portScanError: String? = nil) {
         self.domain = domain
         self.timestamp = timestamp
         self.trackedDomainID = trackedDomainID
         self.extendedSubdomains = extendedSubdomains
         self.dnsHistory = dnsHistory
         self.domainPricing = domainPricing
+        self.reputation = reputation
         self.portScanResults = portScanResults
         self.hstsPreloaded = hstsPreloaded
         self.availabilityResult = availabilityResult
         self.extendedSubdomainsError = extendedSubdomainsError
         self.dnsHistoryError = dnsHistoryError
         self.domainPricingError = domainPricingError
+        self.reputationError = reputationError
         self.portScanError = portScanError
     }
         extendedSubdomains = try container.decodeIfPresent([DiscoveredSubdomain].self, forKey: .extendedSubdomains) ?? []
         dnsHistory = try container.decodeIfPresent([DNSHistoryEvent].self, forKey: .dnsHistory) ?? []
         domainPricing = try container.decodeIfPresent(DomainPricingInsight.self, forKey: .domainPricing)
+        reputation = try container.decodeIfPresent(DomainReputationResult.self, forKey: .reputation)
         portScanResults = try container.decodeIfPresent([PortScanResult].self, forKey: .portScanResults) ?? []
         hstsPreloaded = try container.decodeIfPresent(Bool.self, forKey: .hstsPreloaded)
         availabilityResult = try container.decodeIfPresent(DomainAvailabilityResult.self, forKey: .availabilityResult)
         extendedSubdomainsError = try container.decodeIfPresent(String.self, forKey: .extendedSubdomainsError)
         dnsHistoryError = try container.decodeIfPresent(String.self, forKey: .dnsHistoryError)
         domainPricingError = try container.decodeIfPresent(String.self, forKey: .domainPricingError)
+        reputationError = try container.decodeIfPresent(String.self, forKey: .reputationError)
         portScanError = try container.decodeIfPresent(String.self, forKey: .portScanError)
     }

DomainInspectionService.swift +2

             dnsHistoryError: nil,
             domainPricing: nil,
             domainPricingError: nil,
+            reputation: nil,
+            reputationError: nil,
             portScanResults: portScanResults.value,
             portScanError: portScanResults.message,
             changeSummary: nil,

DomainReportBuilder.swift +2

     let extendedSubdomains: [String]
     let dnsHistory: [DNSHistoryEvent]
     let domainPricing: DomainPricingInsight?
+    let reputation: DomainReputationResult?
     let subdomainGroups: [SubdomainGroup]
     let riskAssessment: DomainRiskAssessment
     let insights: [String]
             extendedSubdomains: snapshot.extendedSubdomains.map(\.hostname),
             dnsHistory: snapshot.dnsHistory,
             domainPricing: snapshot.domainPricing,
+            reputation: snapshot.reputation,
             subdomainGroups: analysis.subdomainGroups,
             riskAssessment: analysis.riskAssessment,
             insights: analysis.insights,

DomainReportExporter.swift +8 −1

                 "Email: \(report.email.summary)",
                 "Subdomains: \(report.subdomains.count)",
                 "Extended Subdomains: \(report.extendedSubdomains.count)",
-                "External Price: \(report.domainPricing?.estimatedPrice ?? "Unavailable")"
+                "External Price: \(report.domainPricing?.estimatedPrice ?? "Unavailable")",
+                "Reputation: \(report.reputation?.status.title ?? "Unavailable")"
             ]
         }
             "pricing_resale_signal",
             "pricing_auction_signal",
             "pricing_source",
+            "reputation_status",
+            "reputation_listed_sources",
             "open_ports",
             "reachability_summary",
             "geolocation_summary",
             let subdomainGroups = report.subdomainGroups.map { "\($0.label):\($0.subdomains.count)" }.joined(separator: " | ")
             let ownershipHistory = report.ownershipHistory.map { "\($0.date.ISO8601Format()) \($0.summary)" }.joined(separator: " | ")
             let dnsHistory = report.dnsHistory.map { "\($0.date.ISO8601Format()) \($0.summary)" }.joined(separator: " | ")
+            let reputationStatus = report.reputation?.status.rawValue ?? ""
+            let reputationListedSources = report.reputation?.listedSources.joined(separator: " | ") ?? ""
             return [
                 report.domain,
                 report.domainPricing?.resaleSignal ?? "",
                 report.domainPricing?.auctionSignal ?? "",
                 report.domainPricing?.source ?? "",
+                reputationStatus,
+                reputationListedSources,
                 openPorts,
                 report.network.reachabilitySummary,
                 report.network.geolocationSummary,

LookupSnapshot.swift +4

     let dnsHistoryError: String?
     let domainPricing: DomainPricingInsight?
     let domainPricingError: String?
+    let reputation: DomainReputationResult?
+    let reputationError: String?
     let portScanResults: [PortScanResult]
     let portScanError: String?
     let changeSummary: DomainChangeSummary?
             dnsHistoryError: dnsHistoryError,
             domainPricing: domainPricing,
             domainPricingError: domainPricingError,
+            reputation: reputation,
+            reputationError: reputationError,
             portScanResults: portScanResults,
             portScanError: portScanError,
             changeSummary: changeSummary,

Commit 6e273c2676

Commit `6e273c2676`