How the Dralvia score works

The score is not a percentage or a probability. It is a sum of weighted findings, capped at 100, and it always maps to exactly one verdict:

A scan opens the link in an isolated browser and runs a set of checks. Each check can raise findings, and each finding carries a weight. The findings fall into these groups:

• Threat feeds and blocklists: the address or domain is already listed as phishing or malware.
• Brand imitation: a lookalike name (paypa1, micros0ft), a known brand's logo or icon on a domain that brand does not own, or a brand name placed in a subdomain to look official.
• Page content: a login, card or one-time-code form, a form that sends what you type to another site, a seed-phrase prompt, or hidden and scrambled scripts.
• Redirects: how many hops the link takes, whether it jumps to another site, and whether it hides where it ends up.
• Domain and registration: how new the domain is, its registration record, its ending (.com, .top, .xyz) and the shape of the address.
• Certificate: whether the site has a valid certificate for its own name.
• DNS and hosting: where the site lives and what else is hosted there.
• Campaign links: whether the link leads somewhere that earlier scans already found in a phishing campaign.

One moderate finding rarely convicts a site on its own. When several independent kinds of evidence appear together, for example a domain registered this week, a login form and a bank's logo, Dralvia adds a correlation finding with a high weight. That is how real phishing reaches Avoid without a single weak signal doing it.

Outside reputation services count too. When one of them reports the site as malicious, the score rises to at least 68, and reports from two or more put it in Avoid.

Three rules pull a score down. Each one is written into the report with the score before and after, so nothing is removed silently.

• A brand's own domain: a scan of a site that is, or sits under, a known brand's real domain scores 0, unless it finds something critical such as a blocklist hit, an invalid certificate or a brand-new registration.
• An established domain: a long-standing domain with a valid certificate, or a long clean history in our scans, is capped at 15 unless this scan finds strong phishing evidence (a login form, brand imitation, a blocklist hit and similar).
• Security hygiene alone: missing security headers are a hardening gap, not phishing. When they are the only findings, the score stays at 6 or below.

None of these rules is based on a name alone. A lookalike of a brand never inherits the brand's trust, and strong evidence always overrides an established domain's cap.

1. 1

   Start with the verdict

   Safe, Caution or Avoid tells you what to do. The number tells you how much evidence sits behind it.

2. 2

   Open Why this score

   It lists the points per group and every adjustment, so the total can be checked by hand. If the parts do not add up to the score, that is a bug and we want to hear about it.

3. 3

   Look at the evidence

   The screenshot shows what the page looked like when we opened it, the redirect chain shows every hop, and the certificate and domain details show who is behind the address.

4. 4

   Check the scan time

   The report says whether it is a fresh scan or a cached result. A stable Safe result can be reused for up to 30 days; riskier results are refreshed sooner. Ask for a fresh scan when it matters.

• A scan is a snapshot. A page can change after we look at it, and some phishing kits show a harmless page to scanners and the real one to victims.
• A real site can carry a scam. A genuine form builder, file-sharing or document site can be Safe as a site while the form or file on it asks for your password. The question is always also: why is this asking me for that?
• A score is about the link, not the message. A Safe link in an email that pressures you to pay an unexpected invoice is still a reason to call the sender on a number you already know.
• We can be wrong. Signed-in users can report a result under Think this result is wrong?, and a security analyst reviews it by hand. The original result stays on record while they look.