Skip to main content
SecurvexWebsite intelligence

Security capabilities

Real checks.
Clear boundaries.

Every capability below is implemented in the scanner. Third-party checks run only when the deployment configures them, and unavailable evidence is always labelled rather than guessed.

Scan a websiteRead the methodology

Analysis layers

Signals from the URL, domain, network, and page.

No single signal decides the outcome. The scanner collects independent evidence, records its provenance, and applies deterministic rules to estimate observed risk.

Lookalike and impersonation analysis

Compares the hostname, subdomain chain, and registrable domain against a maintainable verified official-domain database for Steam, Microsoft, Google, Apple, PayPal, Amazon, Discord, Roblox, Binance, Meta, Instagram, Facebook, TikTok, Netflix, and other brands. Detects misspellings, missing or duplicated letters, number-for-letter and visual character substitutions, extra words and hyphens, combined brand names, misleading subdomains, Unicode/Punycode homographs, and exact brand labels on unrelated registered domains.

Boundary: Similarity is an indicator, not proof. A lookalike can be a legitimate partner, reseller, news site, or fan community, and official-list matches confirm the domain family, not the page.

Deterministic, inspectable scoring

Rules group findings by category and correlate them so repeated evidence does not multiply without limit. The report exposes the scoring groups, provider status, coverage, and missing-data notes behind the verdict.

Boundary: The score is an estimated rating, not a probability.

Optional threat intelligence

Server-side adapters support Google Safe Browsing, VirusTotal, and abuse.ch URLhaus, and a keyless community phishing feed is checked by default. Each returns structured evidence and a status. No provider result is fabricated when a key is absent or a request fails.

Boundary: No-match is not proof of safety. Failed lookups are never scored as clean.

Domain registration context

RDAP data provides registration and expiration dates, registrar, and registry status where available. Recent registration is treated as a contextual risk indicator, not an automatic fraud verdict.

Boundary: RDAP coverage varies by registry and can be unavailable.

TLS and transport evidence

Records the certificate issuer, validity window, days remaining, subject alternative names, protocol, and SHA-256 fingerprint from the actual TLS handshake. HTTP and HTTPS-to-HTTP redirects are highlighted.

Boundary: A valid certificate encrypts traffic; it does not establish legitimacy.

DNS intelligence

Collects public A, AAAA, NS, MX, TXT, and CAA records. Dynamic DNS and tunnel providers are flagged as weak context. Missing records are shown as unavailable rather than interpreted as safety.

Boundary: DNS answers can vary by resolver, location, and time.

Bounded redirect analysis

Follows a limited redirect chain, revalidates every destination, rejects private or reserved addresses, records cross-domain hops, and identifies HTTPS downgrades. Loops and excessive redirects stop the fetch.

Boundary: Client-side redirects and JavaScript navigation are not executed.

Safe content indicators

Parses a size-limited HTML response without a browser. Looks for password forms, cross-domain form actions, hidden iframes, direct downloads, urgency, prizes, crypto or gift-card payment requests, remote-access instructions, and prompt-injection text.

Boundary: Forms are never submitted, files are never opened, and scripts are never executed.

Risk scoring

The verdict is rule-based. The AI does not vote.

Findings are grouped into eight evidence categories. Within each group, findings are sorted by points and correlated with descending weights. This keeps related signals from double-counting while preserving independent evidence.

Confirmed intelligence starts at 90

A confirmed malicious match from a configured provider cannot be hidden by a professional-looking page. Confirmed scores occupy the 90–100 band.

Estimates are capped at 89

Heuristic evidence is valuable but not equivalent to a confirmed threat match. The cap keeps the bands meaningful.

Scores are ratings from observed evidence, not probabilities. They are not calibrated against a labelled benchmark. An “unknown” result means too few independent sources completed, not that the site is clean.

Score bands

0–100, with a separate insufficient-data state.

0–19Low observed risk
20–39Suspicious
40–69Elevated risk
70–89High risk
90–100Confirmed malicious indicator
No scoreUnable to determine

Fewer than two independent sources completed. Not a clean result.

Engineering controls

Security applied to the scanner itself.

Scanning untrusted websites requires treating their addresses and responses as hostile input. These controls protect the service and the network it runs in.

SSRF and DNS-rebinding controls

Only HTTP/HTTPS on ports 80 and 443 is accepted. Hostnames are resolved, every returned address is checked against private, loopback, link-local, carrier-grade NAT, documentation, multicast, and metadata ranges, and the request connects to a pinned public IP.

Redirect revalidation

Every redirect is parsed, credential-free, limited to supported ports, resolved again, and checked before a new connection is opened. Loop detection and a redirect cap stop abusive chains.

Hard resource limits

Connection, response, provider, DNS, and AI calls have timeouts. HTML retrieval is capped at 512 KiB. Request bodies are capped, and concurrent scans and per-client rates are limited.

Server-side secrets

Provider and AI credentials are read only on the server. No key is exposed to the browser, embedded in page HTML, or returned by the health endpoint.

No script execution

The scanner is not a headless browser. It does not execute JavaScript, submit forms, attempt logins, download files, or follow page-level navigation. Retrieved content is treated as untrusted data.

Prompt-injection resistance

Website content and provider evidence are labelled as untrusted. The optional AI explanation must first pass a structured evidence audit, then separate checks for unsupported numbers, domains, provider statuses, safety claims, unsafe advice, verdict conflicts, and instruction injection.

Honest limitations

What this product does not claim.

Security tools become dangerous when their limits are hidden. These are real constraints of this implementation, not fine print.

See the full methodology
  • A low score does not guarantee that a website is safe or legitimate.
  • The score has not been calibrated against a labelled detection benchmark.
  • Client-side rendered content, logged-in areas, CAPTCHAs, and targeted cloaking can remain invisible.
  • Malware downloads are not analysed and no file is executed.
  • Threat-intelligence match quality and coverage depend on the configured providers and their data.
  • The built-in rate limiter is process-local and intended for a single-instance deployment unless replaced.
  • AI output is explanatory only and is not a security control.

Optional AI, constrained

AI writes the explanation. Rules own the verdict.

The AI layer is disabled by default. When enabled, it must audit the evidence and cite real evidence IDs before it writes a summary. Deterministic checks reject invented numbers, domains, provider results, verdicts, safety claims, and unsafe advice. It cannot change the score or findings, and AI can still make mistakes.

How scoring worksScan a Website