Using Jev in Domain Abuse Review: A Workflow Design

Updated: Oct 10, 2026 Articles
Xiaolei Wang

Built the data pipeline foundation and the staged AI pipelines on top of it. Runs model evaluation on EuroHPC supercomputers: measuring the smallest model each production task requires.

In our previous article, we trained a small selector for a single decision inside dksplit, our word splitter for domain names, and tested Jev on the same task: it does in general what that selector does for one job. It chooses among fixed options and says how sure it is. Since then we have run some tests that ask Jev harder questions.

This article follows one of them, from brand protection: when a new domain carries a brand word, is it a problem for the brand? The answer depends on what the name says, what the domain is doing, and the rules a brand case is judged by, so we did not ask it in one step. We built a core workflow around it for one typical case, where the brand keyword appears in the domain name.

The workflow

This core workflow is for judging abuse, so here we discuss only what relates to it. Each new name that contains the brand word goes through three layers. Where a layer uses Jev, it asks one question and gives Jev only the facts that question needs. Fixed lines turn the answer into one of three bins: Release (no action), Watch (checked again when the domain changes) or Flag (handed on to the follow-up step). What a layer cannot settle goes on to the next.

Workflow diagram: candidate names containing the brand word pass through three layers. Layer 1 asks whether the name is related to the brand and releases or flags it, or passes it on when unsure. Layer 2 asks whether the domain is in use and sends unused domains to Watch. Layer 3 checks the use against UDRP-based criteria and releases, watches or flags it.
Figure 1. Three layers, three bins. Jev answers the questions; the reviewer makes the call.

Layer 2 is a lightweight pipeline for data collection and status checks: domains that do not resolve or do not respond are routed straight to Watch by system rules, without spending any model compute. We explain Layers 1 and 3 in detail below.

Layer 1: the name alone

This layer’s test is simple. We only want to set aside the names that are innocent and the names that are a problem. Jev sees a short description of the brand, with its marks, and the SLD, the part of the domain left of the dot: the TLD is left out so it cannot affect the score, and an SLD registered on several TLDs gets one score. Jev answers one question: Does this domain name refer to Apple Inc. or its products or services? The answer is a probability. After several runs on different groups of names, we set two lines: below 0.3 a name is released, at 0.7 or above it is flagged, and the rest go on.

We sent in 100 domains, all containing apple; they carry 95 SLDs (the list is on Hugging Face). Jev released 18 of the 100 domains, flagged 24 and passed 58 on to Layer 2:

Bar chart of Layer 1 scores for 100 domains containing apple: 18 released below 0.3, 58 passed on between 0.3 and 0.7, 24 flagged at 0.7 or above.
Figure 2. Layer 1 on the 100 domains: 18 released, 58 passed on to Layer 2, 24 flagged.

One example from each bin:

BinDomainScoreWhat the name says
Released, below 0.3greenapplefruitmart.com0.15apple, the fruit
Passed on, 0.3 to 0.7applerepairzones.com0.69apple next to repair zones; the name alone does not settle it
Flagged, 0.7 or aboveapplewatchzone.com0.89contains the mark Apple Watch

Here is the complete request for applerepairzones.com, as sent to Jev:

{"state": {"brand": {"name": "Apple Inc.",
   "summary": "Apple Inc. is an American technology company that designs and sells consumer electronics, software and online services.",
   "trademarks": ["APPLE", "Apple logo", "iPhone", "iPad", "Mac", "MacBook", "iMac", "Apple Watch", "AirPods", "Apple TV", "Apple Vision Pro", "iPadOS", "macOS", "watchOS", "iCloud", "Apple Pay", "Apple Music", "App Store", "Apple Store", "AppleCare", "FaceTime", "iMessage", "Siri", "Find My"],
   "official_domains": ["apple.com", "icloud.com"]},
  "domain_name": "applerepairzones"},
 "model": "jev-latest",
 "questions": {"refers": {"type": "noul",
   "instructions": "Does this domain name refer to Apple Inc. or its products or services?"}}}

And Jev’s answer:

{"model": "jev-1.13.0",
 "answers": {"refers": {"type": "noul", "noul": 0.7}},
 "usage": {"input_tokens": 488, "output_tokens": 21}}

The three runs gave 0.70, 0.70 and 0.68, for a mean of 0.69: between the lines, so the name goes on to Layer 2.

To check how Jev behaves under different conditions, we ran one more detailed test. We took three names that scored around 0.5, replaced apple with google, and ran Layer 1 again for Google LLC, three times each:

applegoogle
apple41.top 0.53google41.top 0.46
aionapple.com 0.50aiongoogle.com 0.45
applespepites.com 0.53googlespepites.com 0.50

All three names remained in the middle band after replacing Apple with Google.

Layer 3: the use, under UDRP

Once Layer 2 has passed on the domains with activity (a built site, a page offering the domain for sale or a parking page), this layer asks one question. It draws on the UDRP (the Uniform Domain-Name Dispute-Resolution Policy), with a narrower standard: whether the name was registered to target the brand, and whether it is used to profit from the brand’s reputation in the brand’s field or a related field. Cases the UDRP also covers, such as registering a name to sell it to the brand owner, fall outside this question. The question:

Drawing on the UDRP, was this domain name registered to target the APPLE brand, and is it used to profit from the brand’s reputation through goods, services or content in the brand’s field or a related field?

Of the 58 domains Layer 1 passed on, Layer 2 found 26 in use, and these came to Layer 3. The lines are the same as in Layer 1: below 0.3 a domain is released, at 0.7 or above it is flagged, and the rest go to Watch. Jev released 13, put 12 on Watch and flagged 1:

Bar chart of Layer 3 scores for 26 domains in use: 13 released below 0.3, 12 on Watch between 0.3 and 0.7, 1 flagged at 0.7 or above.
Figure 3. Layer 3 on the 26 domains in use: 13 released, 12 on Watch, 1 flagged.

One example from each bin:

BinDomainScoreWhat the site shows
Released, below 0.3greenapplemenu.com0.26a family restaurant’s menu
Watch, 0.3 to 0.7aionapple.com0.41a community about AI on Apple’s platforms
Flagged, 0.7 or aboveapplerepairzones.com0.80Apple device repair services

We can now return to applerepairzones.com, which scored 0.69 on its name alone. Its page advertises Apple repair services, giving Jev more to work with. The complete request below combines the brand description with the registration, DNS, page and HTTP data collected by Layer 2. The page is represented by its title, metadata and a text excerpt; the HTML itself is not sent:

{"state": {"brand": {"name": "Apple Inc.",
   "summary": "Apple Inc. is an American technology company that designs and sells consumer electronics, software and online services.",
   "trademarks": ["APPLE", "Apple logo", "iPhone", "iPad", "Mac", "MacBook", "iMac", "Apple Watch", "AirPods", "Apple TV", "Apple Vision Pro", "iPadOS", "macOS", "watchOS", "iCloud", "Apple Pay", "Apple Music", "App Store", "Apple Store", "AppleCare", "FaceTime", "iMessage", "Siri", "Find My"],
   "official_domains": ["apple.com", "icloud.com"]},
  "domain": {"domain": "applerepairzones.com",
   "whois": {"reg_date": "2026-08-22",
    "exp_date": "2027-08-22",
    "registrar": "GoDaddy.com, LLC",
    "ns": ["aster.dns-parking.com", "helios.dns-parking.com"],
    "status": ["client delete prohibited",
     "client renew prohibited",
     "client transfer prohibited",
     "client update prohibited"]},
   "dns": {"has_mx": true,
    "mx_provider": "Hostinger mail",
    "mx_hosts": ["mx1.hostinger.com", "mx2.hostinger.com"],
    "cname": null,
    "resolves": true,
    "a_records": ["147.79.79.0", "147.79.72.98"]},
   "page": {"title": "Apple Repair Zone",
    "meta_description": null,
    "language": "zxx",
    "text_excerpt": "Apple Repair Zone Enquiry Form × CALL US : +91-7052798120 Email : info@example.com --> --> Book Now HOME ABOUT US SERVICES GALLERY CONTACT US Home Home 1 Home 2 Home 3 Home 4 Home 5 Home 6 Home 7 Home 8 New --> --> Search Your keyword All Types Of Apple Repair Specialist. | Free Pickup & Drop Av"},
   "http": {"fetch_result": "ok",
    "status_code": 200,
    "final_url": "https://applerepairzones.com/",
    "redirected_to_other_host": false,
    "error": null}}},
 "model": "jev-latest",
 "questions": {"related": {"type": "noul",
   "instructions": "Drawing on the UDRP, was this domain name registered to target the APPLE brand, and is it used to profit from the brand's reputation through goods, services or content in the brand's field or a related field?"}}}

And Jev’s answer:

{"model": "jev-1.13.0",
 "answers": {"related": {"type": "noul", "noul": 0.79}},
 "usage": {"input_tokens": 928, "output_tokens": 20}}

The answer is a single probability. We ask the question three times and use the mean; for this domain, the three runs gave 0.79, 0.81 and 0.81, for a mean of 0.80 to two decimal places. The repair site gives us a concrete example of the progression through the workflow: the name passed through Layer 1, and the record of its use now flags it.

Among those on Watch is aionapple.com, a community exploring AI on Apple’s platforms. Its name had scored 0.50 in Layer 1; with the site’s content available, Jev answered the Layer 3 question at 0.41. The connection to Apple is clear from the page, but that still leaves the question of how the site uses that connection. A community discussing a brand’s platforms gives us a different case to examine alongside the repair business.

To explore what Jev was responding to in the community example, we compared changes to the brand with changes to the site’s stated purpose. We made a synthetic Google version of the record and, for each brand, compared the original independent-community description with a version describing the community as for-profit. Each score is the mean of three new runs, so the original record shows 0.43 here against 0.41 above:

RecordIndependent (original)For-profit
aionapple.com0.430.65
aiongoogle.com (synthetic)0.400.63

The same pattern appears with both brands. Changing Apple to Google moves the score little, while describing the community as for-profit raises it by about 0.2. Both versions stay on Watch, below the Flag line. In this example, Jev’s answer responds to how the community describes its purpose, and the workflow leaves the changed case open for further observation.

Summary

Our design is a plan for an AI workflow based on the UDRP, in an assisting role. It covers the core of the judgment only, without visual information, a UDRP case database or the later processing a real case needs, so it is not meant for real judgments. Within that scope, its features are:

An error points to one layer: splitting the review into several steps makes it easy to embed in a data flow or to run concurrently, and makes it easier to find exactly where an error occurs. For example, when we gave Layer 1 the full domain, Jev scored applepie.top 0.39 and applepie.net 0.29, while three runs on one domain differed by 0.03 at most in that test. Layer 1 therefore sends the SLD without its TLD, which keeps this effect out of the name judgment.

Controlling the question improves Jev’s performance: Jev is a great model, but what matters most in embedding it in a workflow is still how we give it a framework for answering questions. Used as decision support and constrained by the prompt, it gave answers to the two questions here that our lines could sort, with little variation between runs.

Tests were run with Jev 1.13.0 through the TypeSafe AI API, on 100 domains containing apple drawn from those registered in the 60 days to 9 October 2026 (DomainKits NRD data). The 100 include eight controls added by hand: applepie, appleproduct and appleios on several suffixes. The requests shown in this article are complete; to repeat a score, send one as shown and take the mean of three runs. Page content was passed to the model as data. No registrant data was collected or used. The 100 domains and the records passed to Jev are on Hugging Face: ABTdomain/domain-tech-meta. Download Newly Registered Domains List

Related Posts