How the analysis actually works
SentinelScope runs nine pipeline stages against every target, entirely passively. Nothing here is simulated — each stage is a real DNS query, TLS handshake, HTTP request, or third-party API call, and its real completion is what drives the score below, not a template.
The Pipeline
- 1
Target Validation
Parses the input and rejects anything pointed at private, loopback, or reserved address space before any network call is made.
- 2
DNS Intelligence
Resolves A/AAAA/MX/NS/TXT/CNAME/SOA/CAA records plus a DMARC lookup, tolerant of any single record type being absent.
- 3
IP Intelligence
ASN, organization, and geolocation for the resolved address, plus a real reverse-DNS lookup.
- 4
TLS Analysis
A real TLS handshake against the target, pinned to its validated IP — certificate chain, protocol version, and expiry.
- 5
HTTP Analysis
One SSRF-safe fetch, redirect chain included, graded against six standard security headers.
- 6
Technology Detection
Passive fingerprinting of server, CDN, framework, and CMS from the same response — no separate probing requests.
- 7
Domain Intelligence
Registrar, registration date, and status via RDAP, the IETF-standard successor to WHOIS.
- 8
Threat Intelligence
VirusTotal and AbuseIPDB, only when their API keys are configured — otherwise reported as unavailable, never guessed.
- 9
Risk Engine
Combines every stage's real findings into one weighted score. See below.
Risk Score
The score is a weighted average of the factors below. A factor whose data is unavailable — no threat-intel API key configured, a failed lookup — is excluded from the average entirely, and the remaining weights are renormalized. Missing data is never silently scored as safe or risky.
| Factor | Weight | Signals |
|---|---|---|
| TLS Security | 22% | Certificate validity, expiry, protocol version |
| HTTP Security Headers | 20% | HSTS, CSP, X-Frame-Options, and four others |
| DNS Configuration | 12% | CAA, SPF, DMARC, nameserver redundancy |
| Domain Reputation | 12% | Registration age, RDAP status flags |
| IP Reputation | 12% | AbuseIPDB confidence score |
| Threat Intelligence | 14% | VirusTotal engine verdicts |
| Configuration Findings | 8% | Information disclosure, missing HTTPS redirect |
A+/A
0–19
B
20–39
C
40–59
D
60–79
F
80–100
Security Commitments
- SSRF protection. Every outbound request to a user-supplied target — and every redirect hop it follows — is resolved and validated against private, loopback, and reserved address space, then pinned to that validated IP for the actual connection.
- No fabricated data. A provider with no configured API key or a failed lookup is reported as “Unavailable,” never filled in with a guessed score.
- No cross-visitor history. A direct
/analysis/[id]link is shareable on purpose; the list of recent analyses on the homepage is not — it lives only in your own browser. - Passive only. No exploitation, credential attacks, or denial of service — ever.