METHODOLOGY
HOW WE LOOK TWICE.
The SecondLook turns a screenshot or link into a list of typed findings. A fixed, deterministic formula turns those findings into a score. AI is used only to read text and to tag message wording from a fixed list — it never sets the score.
Detection layers
- Link: threat-intelligence feeds (when configured), lookalike brands, shorteners, safe server-side redirect following, address patterns.
- Domain: registration age (RDAP), DNS records, certificate history (Certificate Transparency).
- Message: wording patterns such as urgency, requests for codes, payment or credentials, impersonation.
- Screenshot: text extraction, then regex extraction of links, phone numbers, emails and payment identifiers.
Scoring rules
- Points per finding = weight × confidence, rounded.
- Category caps: Link 45, Domain 25, Message 40, Screenshot 15.
- AI-sourced findings add at most 40 points in total.
- A confirmed threat-feed hit sets a minimum score of 85.
- Mitigations can reduce the score by up to 15, never below 5.
- 0–24 Low · 25–49 Moderate · 50–74 High · 75–100 Critical. Low scores remain unverified unless a threat check completed cleanly, the domain resolves and is at least a year old, and no warning signals were found. Coverage is informational only.
Weight table
| Signal | Layer | Weight |
|---|---|---|
| Link is flagged by a threat-intelligence sourcethreat_feed_hit | url | +60 |
| Address points at a raw IP number instead of a nameip_literal_host | url | +20 |
| Domain uses lookalike Unicode characterspunycode_homograph | url | +25 |
| Domain closely imitates a well-known brandbrand_lookalike_domain | url | +25 |
| Brand name appears in a subdomain or pathbrand_in_subdomain_or_path | url | +15 |
| Unusually many subdomainsexcessive_subdomains | url | +8 |
| Domain ending is frequently misusedsuspicious_tld | url | +8 |
| Hostname uses trust wordsdeceptive_hostname_keywords | url | +10 |
| Claims to be a government agency, but the link isn't a .gov domaingov_claim_non_gov_link | url | +15 |
| Link goes through a URL shortenerurl_shortener | url | +10 |
| Long or obfuscated addresslong_or_obfuscated_url | url | +6 |
| Link bounces through many redirectsredirect_chain_long | url | +8 |
| Redirect leaves the original domainredirect_cross_domain | url | +8 |
| Address contains credential-related wordscredential_keywords_in_path | url | +8 |
| Address uses an unusual portnon_standard_port | url | +6 |
| Domain registered less than 30 days agodomain_very_new | domain | +15 |
| Domain registered less than 90 days agodomain_new | domain | +8 |
| Registrant details are hidden behind a privacy serviceregistrar_privacy_hidden | domain | 0 |
| Domain sends no mail, but the message claims it doesdns_no_mx_for_email_claim | domain | +5 |
| Certificate first seen very recentlytls_cert_very_new | domain | +4 |
| Domain does not exist or has been taken downdomain_unresolvable | domain | +15 |
| Message creates urgencyurgency_pressure | message | +10 |
| Message asks for credentialscredential_request | message | +18 |
| Message asks for a one-time codeotp_request | message | +22 |
| Message asks for paymentpayment_request | message | +15 |
| Message appears to impersonate an organisationimpersonation_org | message | +15 |
| Message appears to impersonate a person you knowimpersonation_person | message | +12 |
| Message announces a prize or windfallprize_or_lottery | message | +15 |
| Message uses threats or fearthreat_or_fear | message | +10 |
| Message asks to move to another platformoff_platform_move | message | +8 |
| Sender context doesn't add upinconsistent_sender_context | message | +10 |
| Unsolicited job or investment offerunsolicited_job_or_investment | message | +14 |
| Message tries to instruct the analyzerprompt_injection_attempt | message | +10 |
| Unusual wording or grammargrammar_anomalies | message | +3 |
| Sender name doesn't match the claimed organisationsender_name_mismatch | screenshot | +10 |
| Visible link text doesn't match its addresslink_text_mismatch | screenshot | +10 |
| Message from an unknown numberunknown_sender_number | screenshot | +4 |
| Text extraction had low confidenceocr_low_confidence | screenshot | 0 |
| Exact match to a well-established domainestablished_domain_allowlist | domain | -15 |
Limits and what we don't check
- We don't load or inspect page content, files or JavaScript, and we don't scan for malware.
- “Not listed” in a database never means safe. New scams appear faster than any list.
- A valid HTTPS certificate doesn't make a site trustworthy, and a new domain isn't automatically malicious.
- Text extraction can miss details in blurry or cropped screenshots.