Technical Overview

If the user has correctly added bankoftrust.com to their watchlist, the app will:

• Treat bankoftrust.com as a trusted root domain
• Skip domain-level penalty checks for it
• Still flag any use of “bankoftrust” in unrelated subdomains or domains

Pasted URL: https://secure-login.trustedbank.com.userauth-check.info/session?token=xyz

URL Breakdown:

• Domain: userauth-check
• TLD: .info
• Subdomain: secure-login.trustedbank.com
• Path: /session
• Query: token=xyz

Offline analysis:

Conclusion:

• Subdomain + .info TLD + API-style path forms a high-risk pattern
• Offline logic recognizes this combo and applies a critical penalty
• Total score drops to 0/100
• Online check is skipped — it's already flagged as too risky

Verdict:

This URL impersonates a known brand using a deceptive subdomain, a suspicious TLD, and a query path that mimics login flow.
Final Score: 0/100 — flagged as DANGEROUS

Let’s say a user encounters a shortened link in a promoted X.com post:
Pasted URL: bit.ly/mihoyanagi

Initial URL Breakdown:

• Domain: bit
• TLD: .ly
• Path: /mihoyanagi

Offline analysis:

--> Score 90

Online analysis begins

Request sent with real iOS User-Agent and clean headers

Redirect 1: https://jolyvip.com/mihoyanagi

Final URL: https://coingrok.io

Verdict:

This link leads through a redirect chain with cookie abuse, tracking attempts, and excessive inline scripts.
Final domain leaks stack metadata and hosts CSP violations.
Final Score: 0/100 — flagged as DANGEROUS

Let’s consider the following link:
https://www.man-entreprise.com/vrp/ayxxxxxxx/yyyy
(Query parameters have been altered to avoid exposing personal data.)

Initial URL Breakdown:

• Domain: man-entreprise
• TLD: .com
• Path: /vrp/ayxxxxxxx/yyyy

Offline Analysis:

→ Score remains 100

Online Analysis Begins

Request sent with real iOS User-Agent and clean headers

Redirect 1: https://ed.manageo.biz/clt-su/SFR/formulaire16_2tps.jsp?...

TLS Certificate (from man-entreprise.com)

→ Strong signal of cloaking infrastructure via shared certificate

Final URL: https://ed.manageo.biz

Verdict:

This link leads to a suspicious redirect chain starting from a clean domain that shares a Let's Encrypt DV certificate with 76 unrelated sites.
It lands on a .biz domain serving cloaked or obfuscated JavaScript, with leaked personal data and malformed query patterns.
The final destination shares a similarly structured certificate — indicating shared scam infrastructure at scale.

Final Score: 0/100 — flagged as CRITICAL

These sites are globally recognized — but when analyzed blindly, as if they were unknown, their setups fall short.

These aren’t scams - but if we didn’t already trust them, nothing in their technical behavior would give trust signal.
This shows hygiene gaps, not proven scams. Inline scripts are currently penalized equally; future versions will reduce the penalty if nonce-matching is detected.

Some high-profile sites make a visible effort to secure users — and it shows.

Stripe clearly wants to appear trustworthy — and backs it up with real protections al inline are protected by a hash, and a EV cert.
The French government site is solid and has a EV cert.
Apple's CSP still allows unsafe-inline/unsafe-eval; referrer policy is lax, the EV cert helps.

### SAN‑pattern analysis – spotting cloaked infrastructure

LegitURL examines the Subject Alternative Name (SAN) list for signals that a certificate is protecting more than just a normal “set of sub‑sites.”

#### Red‑flag pattern

Many (10 – 100) unrelated FQDNs, no wildcard entries, and a certificate age < 30 days - especially when the issuer is Let’s Encrypt, strongly suggests throw‑away scam infra.

A SAN list packed with unrelated domains is therefore scored as “Cloaked Infra”.
When combined with weak headers, shady TLDs (.biz, .click), or obfuscated JavaScript, the overall risk escalates quickly.

#### Counter‑example: Steam

• steampowered.com → 48 SAN entries, Let’s Encrypt DV, no wildcard.
• Immediate redirect to store.steampowered.com → EV cert, only 2 SANs.

Because the chain lands on a stronger, scoped EV certificate, LegitURL waives the penalty for the first hop, context overrules the raw SAN count.

One real-world example involved the domain portal-finance.net:

• The model correctly:
  • Flagged the domain as visually and phonetically similar to “binance”, using the app’s Levenshtein and n-gram results
  • Identified the external file /hidden/payload.js as suspicious due to its naming
    • This is exactly what LegitURL was designed to highlight — the model connected filename patterns to real threats
  • Noted the absence of CSP, HSTS, and SRI headers
  • Connected the TLS issue date (same-day issuance) to likely phishing deployment

All without relying on brand blocklists — purely via behavioral pattern recognition.

This confirmed that the combination of exported JSON + well-primed instructions can enable GPT-4o, Gemini, Claude or DeepSeek to produce a strong, accurate risk explanation from raw technical input. While the priming is still refined manually, the balance between guiding and overconstraining the model remains a key challenge.

The model’s ability to leverage background knowledge is exceptionally powerful. Prior attempts to detect such threats relied on static brand lists, dictionary lookups, or entropy checks — all of which struggled against infinite variations. This new pipeline offers a more flexible and adaptive path forward.

As of now, LegitURL measures JSON export efficiency not only by minimizing token size (still a work in progress), but also by evaluating the cognitive load placed on the model,that is, how easily it can extract structure, identify key signals, and reason across findings.

LegitURL remains a fully offline local tool, but this JSON export adds a new layer: enabling models to provide meaningful insight without deep technical parsing. Suspicious inline script snippets are extracted, structured, and passed in clean blocks — letting models focus on interpretation, not AST traversal.

Claude Sonnet 4:

Looking at the technical behavior of portal-finance.net, I see several concerning signals that suggest this site should be approached with extreme caution.

## Critical Red Flags

**Domain Impersonation**: The domain "portal-finance.net" appears designed to mimic Binance, one of the world's largest cryptocurrency exchanges. The analysis shows "FINANCE" has a Levenshtein distance of only 1 from "binance" and 71% structural similarity. This is a classic impersonation tactic used by scammers to trick users into thinking they're visiting a legitimate financial platform.

**Brand New Certificate**: The TLS certificate was issued just yesterday (May 29, 2025) - literally 0 days old when tested. Legitimate financial services don't typically launch with same-day certificates. This suggests the site was created very recently, which is common with scam operations that get shut down and recreate quickly.

**Suspicious Script Loading**: The site loads an external script from a relative path `./assets/hidden/payload.js` - the name "payload" combined with being in a "hidden" directory is highly suspicious. Legitimate sites don't typically name their JavaScript files "payload" or hide them in directories with such obvious names. This could contain malicious code.

## Security Hygiene Issues

The site exhibits poor security practices across multiple areas:

- **Missing Security Headers**: No Content Security Policy, X-Content-Type-Options, Referrer-Policy, or HSTS headers. This creates vulnerabilities and suggests the operators don't follow security best practices.
- **No Script Integrity**: External scripts lack Subresource Integrity (SRI) hashes, meaning if the jQuery CDN or the local server were compromised, malicious code could be injected.
- **Aggressive Caching Prevention**: The "no-store" cache control header prevents any caching, which while not inherently malicious, is unusual for static content and could indicate frequently changing content.

## Behavioral Context

The inline JavaScript appears benign (clipboard copying functionality), but this could be a facade. The real concern is the external "payload.js" script that wasn't analyzed but has a highly suspicious name and location.

## Trust Assessment

This combination of signals - domain impersonation of a major crypto exchange, same-day certificate issuance, suspicious script naming, and poor security hygiene - creates a pattern consistent with cryptocurrency scam sites. These operations typically create convincing-looking finance portals to steal login credentials or crypto wallet information.

A cautious user should avoid this site entirely. The technical behavior suggests it was hastily constructed to impersonate Binance, likely for fraudulent purposes. The risks far outweigh any potential legitimate use case.​​​​​​​​​​​​​​​​