{"keyless_sources":[{"source":"rdap","name":"RDAP / WHOIS registration","kind":"registration","license":"public registry data","attribution":"RDAP bootstrap (rdap.org -> authoritative registry)"},{"source":"doh","name":"DNS-over-HTTPS resolvers","kind":"dns","license":"public DNS","attribution":"Google / Cloudflare / Quad9 public DoH; Cloudflare DO-bit for DNSSEC"},{"source":"tls","name":"Live TLS certificate handshake","kind":"tls","license":"n/a (own connection)","attribution":"computed by us"},{"source":"crt.sh","name":"Certificate Transparency (crt.sh)","kind":"ct_history","license":"public CT logs","attribution":"crt.sh (Sectigo) — public Certificate Transparency search"},{"source":"certspotter","name":"SSLMate certspotter (CT fallback)","kind":"ct_history","license":"public CT logs","attribution":"SSLMate Cert Spotter API (best-effort fallback)"},{"source":"lexical","name":"Typosquat / homoglyph / shape analysis","kind":"lexical","license":"n/a (own compute)","attribution":"computed by us (tldextract PSL snapshot + rapidfuzz)"}],"blocklist_feeds":[{"source":"safebrowsing","name":"Google Safe Browsing","kind":"blocklist","env_var":"SAFEBROWSING_API_KEY","configured":false,"commercial_use_permitted":true,"attribution":"Google Safe Browsing (https://safebrowsing.google.com); requires a Google API key. Threat status only, not redistributed."},{"source":"urlhaus","name":"abuse.ch URLhaus","kind":"blocklist","env_var":"URLHAUS_AUTH_KEY","configured":false,"commercial_use_permitted":true,"attribution":"URLhaus by abuse.ch (https://urlhaus.abuse.ch); requires an abuse.ch Auth-Key. Listing status only, not redistributed."}],"blocklist_note":"Blocklist feeds are OPTIONAL and OFF by default (env-gated). When configured we return ONLY the boolean fact of a listing + attribution — we never redistribute the feed and run no bulk daemon.","excluded":[{"source":"openphish","reason":"OpenPhish ToU forbids commercial use (like OpenSanctions CC-BY-NC) — excluded."}],"dimensions":["age","dns_posture","tls","ct_history","lexical","blocklist"],"disclaimer":"These are automated trust/phishing indicators, NOT a guarantee and NOT legal or financial advice. A high score is not an endorsement; a low score is not proof of fraud. A legitimate new business can score low; verify independently before transacting."}