The canonical headshot site and the phishing checklist

The headshot site is served at headshotin.com. The play entry route is served at headshotin.com/Login/playnow. Any other URL claiming to be a headshot surface is a third-party surface that the desk does not control. The URL bar is the single most reliable phishing defence for editorial brands.

Verify the domain, verify the path, verify the certificate. The desk does not authorise any third-party mirror, app store listing or APK distribution channel. The only canonical source for headshot content is the central URL.

The headshot favicon is a high-contrast monogram in cobalt blue with an amber accent. The favicon is published at /favicon.ico in multi-size format (16, 32, 48, 64, 128, 256). The favicon is also published as a PNG at /apple-touch-icon.png. The favicon is the desk's authoritative browser-tab icon.

For readers who want to verify the canonical site, the favicon is a useful additional signal. A legitimate headshot surface will show the cobalt-blue monogram in the browser tab. A phishing surface will either show no favicon, a default browser favicon, or a favicon that does not match the canonical one. The mismatch is a strong indicator that the surface is not a headshot surface.

The favicon is not a substitute for the URL bar or the certificate. The favicon is a complementary signal. The desk's standard practice is to publish the favicon at the canonical URL and to use the favicon in every canonical surface. The desk does not authorise any third-party surface to use the favicon; the use is a violation of the desk's editorial standard.

The desk's standard practice is to route phishing reports to the security contact listed on the contact page. The standard report should include the URL of the third-party surface, the date the reader first saw the surface, the device and browser used, and a screenshot if possible. The desk's standard practice is to read security reports in the order they arrive.

For a credible phishing surface, the desk publishes a public note on the newsroom. The note names the surface, the affected reader class, and the verification steps. The desk does not republish a phishing URL in public copy. The desk does not name a phishing surface without verifying the report with a security partner.

For a phishing surface that uses a subdomain of the canonical domain, the desk's standard practice is to contact the canonical domain's hosting provider and the relevant certificate authority. The desk's role is to surface the verification step; the hosting provider's role is to take down the surface. The desk does not have the legal authority to take down a third-party surface.

When a phishing surface is taken down, the canonical list on the official-website page is updated. The desk's standard practice is to keep the canonical list accurate within one working day of a takedown. The list is the desk's authoritative answer to the question "is this surface a headshot surface?"; the list is the desk's commitment to the reader.

The desk also publishes a public note on the newsroom when a credible phishing surface is identified. The note names the surface, the affected reader class, and the verification steps. The note is the desk's editorial record of the takedown. The note is updated when the takedown is verified.

For a reader who arrives at the official-website page after a takedown, the desk's standard practice is to show the canonical list and the public note side by side. The reader can use the list to verify any third-party surface, and the reader can use the note to understand the takedown. The desk's role is to surface the verification step; the reader's role is to apply the step.