How the trust score works
The signals behind a LegitSonar score, how they are weighted, and what the score cannot know.
A score is worth nothing if you cannot see how it was reached. This page sets out what is measured, how it is weighed, and — as importantly — what the number cannot know.
What is measured
Every assessment draws on signals a machine can verify:
- Registration. When the domain was first registered, when it was last renewed, how far ahead it is paid, and whether the registrant is identifiable or redacted. Age is the single most informative signal in this whole set, because fraudulent sites are overwhelmingly young.
- Certificate. Whether TLS is present and valid, who issued it, and at what validation level — a certificate that merely proves control of the domain says far less than one where an authority checked an organisation exists.
- Infrastructure. Where the site resolves, what else sits on the same address, and whether that neighbourhood has a history.
- The page itself. Whether it responds, how quickly, where it redirects, what it declares about itself, and whether it asks for details a site of its kind has no business asking for.
- Reputation. Whether the domain appears on public blocklists and threat feeds.
The six criteria
Those signals are grouped into the six bars shown on every report. Each is scored out of 100 and they are combined into the headline number.
| Criterion | What it reflects |
|---|---|
| Technical certificate | Certificate validity and validation level |
| Reputation | Blocklists and threat feeds |
| Transparency | How much the operator discloses about itself |
| Popularity | Reach inferred from detected tags and traffic signals |
| Domain history | Age, renewals and ownership stability |
| Findings balance | Positive against negative findings in this analysis |
No single criterion decides the outcome. A young domain with an impeccable certificate is still young; an old domain on a bad neighbourhood is still on a bad neighbourhood.
Reading the number
| Score | What it means |
|---|---|
| 80–100 | Nothing examined looked wrong. Ordinary care still applies. |
| 60–79 | Mostly positive, with something worth a second look. |
| 40–59 | Enough concerns to be careful before sharing anything. |
| 1–39 | Strong risk signals. Treat any request for money or details as hostile until proven otherwise. |
The bands are deliberately coarse. The difference between 71 and 74 is noise; the difference between 71 and 14 is not.
Live scans
Pressing Re-run analysis performs the checks live: DNS resolution, a WHOIS lookup, a TLS handshake to read the certificate, and one fetch of the home page. It takes a few seconds and the whole analysis is budgeted so a slow or hostile server cannot hold it open.
Private and internal addresses are refused outright. The scanner will not resolve a request to loopback, link-local or private ranges, which stops it being used to probe networks it cannot see from the outside.
What the score is blind to
This is the part most such pages leave out.
- Whether an order arrives. No technical signal predicts fulfilment. A perfectly configured site can take your money and send nothing.
- Content. The scanner reads structure, not meaning. It does not judge whether prices are plausible or claims are true.
- Change since the scan. Every report shows its analysis date. A site can be sold, compromised or repurposed the following day.
- Newness versus dishonesty. Age weighs heavily because it predicts well across a large population — but it is unfair to any individual honest new business, and pretending otherwise would be dishonest.
- Shared infrastructure. Being on an address with bad neighbours lowers a score. On large budget hosts, that catches innocent sites too.
What is derived, not measured
Two things on a report are computed rather than observed, and you should read them as such:
- The trust history chart shows a plausible path to the current score, not a record of past measurements. Assessments capture a moment; the line before that moment is derived.
- The dates on individual findings are spread around the analysis date for legibility. The findings are real; their individual timestamps are not recorded separately.
Everything else — every score, signal, certificate detail and registration date — is measured.
When it gets it wrong
It does, in both directions, and the honest response is correction rather than defence. If a signal behind a score is wrong, say which one and why: [email protected]. Re-running the analysis first resolves a good share of complaints on its own, because much of what looks wrong is simply stale.