Domain Impersonation and OSINT Triage Tool. Compares a known-legitimate domain (target) against a suspect domain using DNS resolution, X.509 TLS certificates, and RDAP registration data, then produces a deterministic risk score and verdict. Single static binary; standard library plus golang.org/x/sync only.
git clone https://github.com/example/isthislegit.git cd isthislegit CGO_ENABLED=0 go build -ldflags="-s -w" -o isthislegit ./cmd/isthislegit ./isthislegit jdsoft.com jdsoftcareers.com go test ./... |
| Flag | Description |
|---|---|
| -v, --verbose | Append raw cert policy OIDs, TLS details, and RDAP JSON. |
| -j, --json | Output the result summary as JSON for scripting. |
| -k, --insecure | Skip TLS verification for RDAP (weakens results; last resort for devices without CA certificates). |
| --timeout=DUR | Per-call deadline for DNS/TLS/RDAP; Go duration, default 5s. |
| --scale | Print the scoring scale table and exit. |
| -h, --help | Display usage and exit. |
Both domains are fetched concurrently with golang.org/x/sync/errgroup under a 15 second global deadline; each DNS, TLS, and RDAP call carries a 5 second deadline (adjustable with --timeout) and is retried up to 3 times. Total run time equals the slower of the two domains. Fail-closed errors name the underlying cause(s).
parse args --> DNS pre-flight (target + suspect, parallel)
--> fetch target = RDAP + TLS in parallel
--> fetch suspect = RDAP + TLS in parallel
--> fail-closed verify --> score --> render |
Exit codes: 0 on success (including --scale and --help), 1 on bad flags, invalid domains, DNS failure, or failed data-quality verification.
Each domain is probed once by the system resolver plus pinned 1.1.1.1 and 8.8.8.8 servers, and the outcomes are reused downstream. Only state is compared, never raw addresses: system-dark/public-live suppression splits and NS delegation splits flag tampering (+50 on the suspect), while system-live/public-dark split-horizon shapes and target-side splits stay display-only NOTEs. CDN/GeoDNS address churn stays quiet. Inconclusive resolvers abstain; filtered resolvers are excluded by design. The pre-flight gate aborts on system failure with hijack-aware messaging.
The tool runs on embedded ARM devices (verified on a Miyoo Mini Plus), but minimal firmware often ships without a CA certificate store. DNS and certificate inspection still work there, while verified HTTPS (RDAP) fails; the fail-closed error names the cause (x509: certificate signed by unknown authority). Install ca-certificates and fix the clock where possible, otherwise use -k/--insecure as a last resort.
| Signal | Points |
|---|---|
| Suspect < 30d (CRITICAL), stacked w/ signal | +80 |
| Suspect < 30d (CRITICAL), isolated | +40 |
| Suspect 30-89d (WARNING), stacked w/ signal | +40 |
| Suspect 30-89d (WARNING), isolated | +20 |
| Shared cert infrastructure (halves age tier) | x0.5 |
| Identical target/suspect (forced LEGITIMATE) | +0 |
| Resolution tampering: suppression split (suspect) | +50 |
| DNS split-horizon / target-side (display only) | +0 |
| Cert downgrade: target EV/OV vs suspect DV | +40 |
| Registrar mismatch | +30 |
| Same-class issuer difference (display only) | +0 |
| Score | Verdict |
|---|---|
| 0-14 | LIKELY LEGITIMATE |
| 15-39 | LIKELY UNRELATED / MISCONFIGURED |
| 40-50 | SUSPICIOUS - MANUAL REVIEW RECOMMENDED |
| 51+ | LIKELY PHISHING / IMPERSONATION ATTEMPT |