Our checks look only at what anyone on the Internet can already see — which is exactly what an attacker looks at first. No account, nothing to install, and nothing is forced: the checks are non-intrusive.
A link is a link, whether it arrives by SMS, WhatsApp, a social network or email. We follow the first links to their real destination, after removing the parameters that could identify you. No form is filled in, no code is entered, no file is run.
On each link we weigh several signals together:
A few words in the message — “vote for”, “my niece”, “contest”, “your account will be closed” — are a classic lure. On their own they prove nothing; combined with a suspicious link, they raise the alarm.
For an email, we also read the sender checks recorded by the receiving server (SPF, DKIM, DMARC) and the attachments — read as files, never opened.
The verdict gives a risk level, from the most neutral to the most serious, set by the worst signal found. To stay effective, we do not publish the exact thresholds we use — that would simply hand scammers a guide to slip through.
What we keep: a log of each check (date, time, IP address, type) for 12 months; the text of the message for 30 days, to improve detection; and the addresses of dangerous links, without their parameters and without any link to you. Links are compared with a copy of the URLhaus database (abuse.ch) kept on our servers: no link leaves them. Details in our privacy policy.
About 138 checks (204 rules) in 19 categories measure whether the site and its email follow good practice and legal obligations: domain and DNS, email authentication and delivery, certificate and encryption, security headers and cookies, software past its end of support, hosting country and jurisdiction, legal notice, GDPR. 90 and above is solid; below 50 is very poor.
It starts at 100 and loses points for each abuse scenario we find — 15 in all, plus 3 complements: secrets left online (.env files, .git repositories, backups), a database open to the Internet, an abandoned subdomain that someone else could take over, a domain about to expire, exposed admin panels, outdated software, weak encryption, an open redirect… The deepest of these — secrets left online, a database open to the Internet and exposed admin panels — are only shown and detailed after the owner has proved the domain, and explained after payment. The higher the score, the better the site resists.
We look for the entry points an attacker looks for first: a few well-known administration ports on the website’s server (4443, 5001, 5480, 8006, 9090, 9443, 10443), and the names published in the domain’s DNS that look like an entrance (vpn., remote., portal., citrix., owa., vcenter., gitlab.…), on port 443 only. We only read the login page: no username, no password, no exploit.
We recognise VPN gateways (Fortinet, Ivanti, Citrix NetScaler, Palo Alto, Cisco, Check Point, SonicWall, F5), remote-support tools (ScreenConnect, SimpleHelp, MeshCentral, Guacamole, RD Web Access), administration consoles (vCenter/ESXi, Proxmox, iLO, iDRAC, Cockpit, Portainer, phpMyAdmin, Adminer, Jenkins, Kaseya) and exposed applications (Exchange OWA, MOVEit, GoAnywhere, Confluence, Jira, GitLab, Grafana, Kibana, Synology, QNAP). A published administration console is serious; a remote-support tool is a moderate risk; a VPN gateway is normal and does not lower the score — what matters is keeping it up to date. A version is noted only when the page displays it.
AnyDesk and TeamViewer go through their vendor’s servers: nothing is published on the domain’s side, so we cannot see them.
If a domain’s DNS servers do not answer, we report it as a serious problem: without them, the website and the mail cannot be reached by part of the visitors.
Estimated coverage: 60 to 80%. This is not a penetration test: no brute force, no exploit, no injection.
Think of it as a friendly check — a polite knock at the front door: from the outside, we look at whether the best-known, most widely recommended protections are in place, without ever trying to break in.
No password is ever tried and no attack is simulated. Old software is judged on the vendors' end-of-support dates. The deepest checks (more ports and sensitive paths) are only shown and detailed once you have proven that you own the domain, and explained after payment.
The report cites the French legal notice obligations (LCEN), the GDPR and the US CLOUD Act. Our checks also help you meet parts of GDPR article 32, the CNIL cookie recommendations, NIS2 article 21, the Gmail and Yahoo sender requirements and PCI DSS 4.0 — they help, they do not certify compliance.