The four-layer model
- Identity — IP, DNS, WHOIS. Who and where.
- Posture — TLS, headers, age. How professionally is it operated?
- Reputation — blacklists, scores, phishing flags. What does the world say?
- Continuity — monitoring, alerts, history. Does that answer hold over time?