How a scan becomes a verdict.

Eight checks run at the same time and add up to one score. Lists of known bad links count the most; checks of the link itself keep the answer useful when a list is down.

Scoring

Moves the verdict: Google Safe Browsing; threat feeds (URLhaus, OpenPhish, ThreatFox, Spamhaus DBL, SURBL); VirusTotal; the link pattern model, a small model that runs on our server and reads only the link's text.
Supporting: The site's security certificate, domain age and registrar, unusual DNS records, redirects.
Adding up: Every finding adds points, listed in full below. The total is kept between 0 and 100 and sets the band.

Score bands

The score runs from 0 to 100. Unknown and Error results show no score: the site didn't respond or the scan failed, so a number would claim more than we know. Reputation checks still run on Unknown results and are listed with the result.

0–24: Safe
25–54: Suspicious
55–79: Malicious
80–100: Critical

Points for each finding

These are the numbers the scanner uses, not a simplified version. A check that found nothing adds nothing.

Lists of known bad links
Finding	Points
Google Safe Browsing lists the link	62, plus 6 for each further kind of threat, up to 74
URLhaus or OpenPhish lists this exact link	55
URLhaus or OpenPhish lists the site, not this exact link	25
ThreatFox lists the link or its site, at 75% confidence or more	55
ThreatFox lists the link or its site, at lower confidence	40
ThreatFox lists a different link on the same site	25
Spamhaus DBL lists the domain for phishing, malware, or botnet control	45
Spamhaus DBL lists the domain only as low-reputation	25
Spamhaus DBL lists the domain as a legitimate site that has been abused	15
SURBL lists the domain for phishing, malware, or cracked software	35
SURBL lists the domain as abused	20
1 to 4 VirusTotal engines call it malicious	12, 22, 32, or 42
5 or more VirusTotal engines call it malicious	55, plus 5 for each further engine, up to 85
VirusTotal engines call it suspicious	4 for each engine, up to 16

Each listing counts separately, so two lists naming the same link add up.

On shared platforms where anyone can publish, such as github.com or docs.google.com, a listing of the whole site doesn't count; a listing of this exact link still does.

Checks of the link itself
Finding	Points
The link pattern model calls it malicious	45 × the score the model and the structure checks give together (0 to 1), rounded, but at least 25
The link pattern model calls it risky	16 × the score the model and the structure checks give together, rounded
The site's certificate is invalid	28
The site's certificate is untrusted or self-signed	26
The link's own certificate is under 7 days old and its domain under 30 days old	12
The domain was registered less than 30 days ago	15
The domain was registered 30 to 179 days ago	8
The name is punycode, which can hide look-alike letters	8
The name points to 6 or more addresses of one kind (IPv4 or IPv6)	4
The link redirects 3 or more times	8
A redirect goes over plain, unencrypted HTTP	10
The redirects end on a different site	14
The final page asks for a password and sends it to another site	20
The final page hides its code (2 or more signs)	10
The final page embeds a hidden frame, or 3 or more frames	8
The final page's HTML sends you to another site automatically (a meta refresh)	8

No single one of these can make a link Malicious: the most any one adds is 45. Several together can.

The link pattern model reads only the link's site and path, not what follows a ? or #. It reads them twice, with and without https:// and www., leaving out random-looking IDs like those in short links and shared documents (but not one that spells a brand or a word like login or verify), and averages the two readings. In a test on links not used to set its bar, it flagged about 1 in 100 popular sites, pages inside them, and sign-in pages, 3 in 100 official short links, and 16 in 100 account and email links (account confirmation pages, email verification and click-tracking links). It flagged about 36 in 100 links from a public phishing list.

The page checks read the page's HTML as it downloads; they don't run its scripts.

What lowers the score
Finding	Points
60 or more VirusTotal engines call it harmless, none flag it, and its analysis is no more than 30 days old (or has no date)	−10
The domain is 5 or more years old, no list or VirusTotal engine flagged it, and the link is on the domain itself (or its www), not a deeper subdomain or a shared platform	−8

Neither applies when any single finding is worth 45 or more, so a good record never talks down a serious listing.

The rules

Convicts on its own: Any single finding worth 55 or more makes a link at least Malicious by itself: a Google Safe Browsing listing, an exact-link listing on URLhaus or OpenPhish, a ThreatFox listing of the link or its site at 75% confidence or more, or 5 or more VirusTotal engines.
Can't erase a hit: Only the two discounts subtract, and both switch off when any single finding is worth 45 or more. The domain-age discount also switches off when any list or VirusTotal engine flagged the link.
Unknown: A total that would read Safe becomes Unknown when the site didn't answer at all: no web response and no secure connection. We couldn't look at it, so we don't clear it. A higher total stands, because lists can rightly flag a site that's offline.
Look-alike: When we recognise another site's address in a Safe link's subdomain or login name, as in paypal.com.secure-login.xyz, the result reads Look-alike instead. The score doesn't change, and the details still show it. We look for addresses with common endings such as .com or .co.uk, not every possible name, and never in the page part of a link. Your browser does this check; if it can't load the part that does, a Safe result reads Unconfirmed instead of Safe, with no score.

Confidence

Confidence says how much of the picture we saw. It's a figure from 0 to 100% that we show as a word: High from 85%, Moderate from 50%, Low below that.

A Safe result with one of VirusTotal, Google Safe Browsing, or the threat feeds missing, or answering only in part, goes no higher than 79%; with 2 or more, no higher than 69%. Either way it can't be High.
A Safe result resting on a VirusTotal analysis more than 30 days old goes no higher than 85%.
Unknown goes no higher than 40%, so it's always Low.
Every result stays between 15% and 97% (Safe) or 99% (everything else).

How the figure adds up

How the confidence figure adds up, before the limits above. The major lists are VirusTotal, Google Safe Browsing, and the threat feeds.
For	Percentage points
Start	18%
Each check that came back with something to go on	+6
Each check that finished without much (no certificate, no registration record, no answer from the site, or threat feeds that answered only in part and found nothing)	+2
Each check that didn't apply	+1
Each check that failed	−8
Each note about something that couldn't be checked	−2, at most −12 in all
The link pattern model's two members agree / only one answered / they disagree	+8 / +4.4 / +3.6
Safe: each major list that answered clean	+14
Safe: each major list missing or answering only in part	−10
Safe: no major list answered clean	−15
Otherwise: each major list that flagged it (for the threat feeds, a listing strong enough to convict, or a high-confidence Spamhaus DBL or SURBL listing)	+16
Otherwise: each major list that answered clean	−4, at most −12 in all
Otherwise: each major list missing or answering only in part	−5
Otherwise: 2 or more different kinds of finding back it up (say, a list and the link pattern model), not counting weak signs (an invalid certificate, an untrusted certificate, a domain 30 to 179 days old, unusual DNS records, a long redirect chain, hidden page code, embedded frames, and an automatic jump)	+8

The major lists are VirusTotal, Google Safe Browsing, and the threat feeds. The threat feeds count as answering clean only when every feed answered and none listed the site, not even with a shared-platform listing set aside from the score. “Otherwise” means any verdict but Safe and Unknown; Unknown is worked out like Safe, then capped.

Any check that didn't finish is named next to the verdict.

Reading the eight cells

Every result shows one cell per check, always in the same order: VirusTotal, Link pattern (Link Pattern Model), Safe Browsing (Google Safe Browsing), Threat feeds (Threat Feeds), Certificate (TLS Certificate), Registration (Domain Registration), DNS (DNS Profile), Redirects (Redirect Chain). Each cell leads to its check's evidence: in Summary, the question that cites it; in Full, its row. Each kind of answer has its own shape as well as its colour. A cell that found nothing is a thin gray dash, never green: green is kept for a Safe verdict, so a quiet check never reads as an endorsement. The threat feeds' cell reads Flagged the link only for a listing strong enough to convict, or a high-confidence Spamhaus DBL or SURBL listing; a listing of other links on the same site, or a weaker listing, reads Found a warning sign. The certificate's cell reads Didn't apply for a plain-HTTP link that never moves to HTTPS and whose site offers no HTTPS a browser would use instead.

Flagged the link
Found a warning sign
Found nothing
Gave a partial answer
Couldn't run
Didn't apply

Which site a link belongs to

The part of a link that decides who controls it is the registered domain, the name just before the ending such as .com or .co.uk. Everything to its left can be chosen freely by the owner, so paypal.com.secure-login.xyz belongs to secure-login.xyz. Scrutinix shows the registered domain in bold and says so plainly when the rest of the link spells out a different site.

Using the scanner

Summary answers five plain questions, each naming the checks it rests on; Full lists all eight checks. Each Full row expands to its evidence: engines, certificate fields, redirect hops.
Batch checks up to 10 links at once. Rows resolve independently; open any finished row in the scanner for the full result.
Saved scans stay on this device unless you export or share them. See privacy for what the server still processes.

The name

Scrutinix (SCROO-tih-nix), from scrutiny: looking closely before you trust something.