The scanner never browses like a normal user. It retrieves a constrained public response, records what it observed, and separates facts from inferences.
01
Validate the target and analyze the name
The URL must use HTTP or HTTPS, standard web ports, and a public destination. Embedded credentials, private addresses, local hostnames, cloud metadata endpoints, and unsupported schemes are rejected before any network request. The validated hostname is then compared locally against a curated verified official-domain database for typosquats, character substitutions, misleading subdomains, combined brands, and Unicode homographs.
Validation happens again for every redirect destination. Brand analysis is local, keyless, and deterministic.
02
Query reputation sources
The scanner checks a keyless community phishing feed by default and queries any threat-intelligence providers enabled by server-side credentials. Google Safe Browsing, VirusTotal, and URLhaus are separate adapters. A source that is missing, rate-limited, or failing is labelled unavailable.
The feed works without a key; optional provider keys unlock additional sources. A missing key never becomes a fabricated clean result.
03
Collect domain and DNS evidence
RDAP registry data supplies registration age, registrar, expiration, and domain status where the registry provides it. Public DNS supplies A, AAAA, NS, MX, TXT, and CAA records when available.
Missing records are unknown, not safe.
04
Retrieve the public page safely
A limited HTML response is fetched without executing JavaScript, submitting forms, or downloading files. Each redirect is revalidated and the connection is pinned to a resolved public address. Responses are capped by size and time.
TLS certificate details are recorded from the actual handshake.
05
Score the evidence deterministically
Rules group findings by category, apply correlation weights to reduce double-counting, and map the result to a documented risk band. Confirmed malicious intelligence starts at 90. Non-confirmed estimates are capped at 89.
Provider status and missing data are not treated as clean signals.
06
Explain, without overriding
If an AI provider is configured, it must first audit the structured findings and cite real evidence IDs. Only then can it write a short explanation, which is checked for invented facts, contradictory provider or verdict claims, safety assurances, and unsafe advice. It cannot change the score or findings.
AI is optional and explanatory only.
Deterministic scoring
A score with documented inputs.
Findings are grouped into eight categories. Within each category, the strongest finding counts fully and related findings receive descending correlation weights. This reduces the effect of repeating the same underlying signal.
Categories: threat intelligence, impersonation, domain registration, transport security, URL structure, redirects, website content, and DNS.
Two hard boundaries
Confirmed malicious provider matches are placed at 90–100.
Estimated, non-confirmed findings are capped at 89.
Risk bands
The score is an estimated rating, not a probability or a guarantee.
0–19
Low observed risk
No significant weighted indicator in completed checks.
20–39
Suspicious
Some indicators; legitimate explanations may exist.
40–69
Elevated
Several indicators warrant additional caution.
70–89
High
Multiple strong indicators, without a confirmed match.
90–100
Critical
Reserved for confirmed malicious intelligence.
No score
Unable to determine
Fewer than two independent sources completed. This is not a clean result.
What counts as evidence
Provider responses, with their status and query time.
Registry registration dates and statuses, when returned.
DNS records from the scanner's resolver.
The TLS certificate presented by the scanned host.
Redirect destinations and transport downgrades.
Observable page structure and text without executing scripts.
What the scanner cannot see
Pages or content behind a login, paywall, CAPTCHA, or client-side rendering
JavaScript behaviour, pop-ups, browser exploits, or post-load redirects
Downloaded files, malware execution, or archive contents
Email provenance, sender reputation, or the truthfulness of business claims
Domain ownership beyond public registration data
Every page of a website, every subdomain, or every URL variant
Missing data changes confidence, not the score.
If RDAP, DNS, content retrieval, or a provider is unavailable, the report says so and reduces coverage. Missing data does not add points and is never interpreted as a clean signal. Too little evidence produces an “unable to determine” result instead of a low-risk verdict.
Data sources
Third-party sources are optional and explicit.
The deployment operator chooses which integrations to enable. The scan report marks every source as responded, no match, not configured, rate-limited, timed out, or failed. Provider names do not imply endorsement or affiliation.
Google Safe Browsing
Malware, social engineering, and unwanted software list matches.
VirusTotal
Existing multi-engine analysis for the exact URL; no new submission.
abuse.ch URLhaus
Hostname associations with malware-distribution URLs.
Phishunt community feed
Keyless rolling list of active suspicious phishing hostnames.
RDAP registries
Registration dates, registrar, status, and expiration data.
DNS resolver
Public address, nameserver, mail, TXT, and CAA records.
TLS handshake
Certificate issuer, validity window, SANs, and fingerprint.
Securvex URL rules
Lookalikes, encoding, hostname structure, and brand similarity.
Safe content parser
Page metadata, forms, iframes, downloads, and pressure language.