How the checks work, and how we keep them accurate
Every result here can be traced back to something we observed. These are the rules.
Six principles
- Evidence first. Each finding shows what was observed: the record, the header, the date, the answer text. If we cannot observe it, we say "could not check" and leave it out of the score instead of guessing.
- Fixed, published scoring. A pass earns a check's full weight, a warning half, a problem nothing. Informational items never count. Section weights are listed on every report. The same input on the same day gives the same score.
- AI is a reader, not a judge. Language models do three narrow jobs: reading your website into a short profile (checked against your own text), answering buyer questions with live web search (the answers we measure), and reading message text. In Legit Check, a model's reading can move the risk score by at most 20 points; it can never create a scam verdict on its own.
- False alarms are designed out. Speed is the best of three requests, so one slow moment does not fail a site. A lookalike domain counts only if it was registered in the last year, mentions your name, or can receive mail and is new; old unrelated sites are listed separately. A site that blocks automated checks is marked "could not check", not "failed".
- Honest wording. No check says "safe" or "fake". Legit Check's best result is "no red flags found". Trust Guardian reports how far numbers sit from normal patterns, never that an account or review is fake.
- Passive only. We read public information the way a browser or search engine does: DNS, one secure connection, public pages, public registries and public phishing lists. No port scans, no login attempts, no probing hidden paths. Deeper testing happens only under a signed engagement with the system's owner.
Company Check
Six sections with fixed weights: security 25%, email protection 15%, technical health 15%, search and AI presence 20%, trust and presence 10%, privacy and accessibility 15%. Platform versions are compared with the vendor's current release. Domain dates come from RDAP, the official successor of WHOIS. The blocklist check uses Spamhaus DBL; if it cannot be queried, the result is "could not check".
Search and AI Visibility
We read your home page and up to six more pages. Buyer questions are built from fixed templates using the category and location stated on your site, so next week's run asks exactly the same questions. "Named" means your domain or your exact business name appears in the answer or its sources; partial matches do not count. Questions the engine fails to answer are left out, not counted against you. This version measures one AI assistant with live web search; ChatGPT, Gemini, Perplexity and Google AI Overviews are being added, and each will be reported separately.
Legit Check
Hard evidence carries the most weight: a listing in a public phishing feed, a brand name on a domain that is not the brand's, a domain registered days ago, an IBAN that fails its checksum. Message patterns (for example a "new number" plus a request for money) add to it. 60 or more is "likely scam", 25 to 59 "be careful", below 25 "no red flags found". Phone numbers and bank accounts can only be checked for format, country and type; nobody can see from outside who owns them, and the result says so.
Trust Guardian
Engagement is compared with a reference range for the platform and audience size. The ranges are deliberately wide and are being calibrated against measured accounts. Reviews are checked for near-copies, same-day bursts, clusters of very short five-star reviews and polarised patterns. Results for other people's profiles stay private to the person who ran the check.
Measured accuracy
Before release, Legit Check was run against 40 live phishing links taken from a public phishing feed, with the feed lookup switched off so it had to judge them on its own signals, and against 30 well-known legitimate sites, including login pages, banks and shops in the regions we serve (3 November 2026).
- Live phishing links flagged as "likely scam" or "be careful": 27 of 40 (68%). With the feed lookup on, as in normal use, links already listed in the feed are always flagged.
- Legitimate sites wrongly flagged: 0 of 30.
The misses were mostly pages planted on hacked websites and links behind shorteners that had already been taken down. We repeat this test with every change to the rules, add sources as they become available, and publish the new numbers here. If a result looks wrong, tell us at contact@itovio.com.