isthislegit? [v1.01]
Domain Impersonation and OSINT Triage Tool. Compares a known-legitimate
domain (target) against a suspect domain using DNS resolution, X.509 TLS
certificates, and RDAP registration data, then produces a deterministic risk
score and verdict. Single static binary; standard library plus
golang.org/x/sync only.
Build and Run
git clone https://github.com/example/isthislegit.git
cd isthislegit
CGO_ENABLED=0 go build -ldflags="-s -w" -o isthislegit ./cmd/isthislegit
./isthislegit jdsoft.com jdsoftcareers.com
go test ./... |
Flags
| Flag | Description |
|---|
| -v, --verbose | Append raw cert policy OIDs, TLS details, and RDAP JSON. |
| -j, --json | Output the result summary as JSON for scripting. |
| --scale | Print the scoring scale table and exit. |
| -h, --help | Display usage and exit. |
Fetch Pipeline
Both domains are fetched concurrently with
golang.org/x/sync/errgroup under a 15 second global deadline; each
DNS, TLS, and RDAP call carries a 5 second deadline and is retried up to 3
times. Total run time equals the slower of the two domains.
parse args --> DNS pre-flight (target + suspect, parallel)
--> fetch target = RDAP + TLS in parallel
--> fetch suspect = RDAP + TLS in parallel
--> fail-closed verify --> score --> render |
Exit codes: 0 on success (including --scale and
--help), 1 on bad flags, invalid domains, DNS failure, or
failed data-quality verification.
Scoring Scale
| Signal | Points |
|---|
| Suspect domain age < 30 days (CRITICAL) | +80 |
| Suspect domain age 30-89 days (WARNING) | +80 |
| Cert downgrade: target EV/OV vs suspect DV | +40 |
| Registrar mismatch | +30 |
| Same-class issuer difference (display only) | +0 |
| Score | Verdict |
|---|
| 0-14 | LIKELY LEGITIMATE |
| 15-39 | LIKELY UNRELATED / MISCONFIGURED |
| 40-50 | SUSPICIOUS - MANUAL REVIEW RECOMMENDED |
| 51+ | LIKELY PHISHING / IMPERSONATION ATTEMPT |
Packages
- dns - normalization, syntax checks, DNS pre-flight.
- cert - TLS leaf fetch and validation-level classification.
- rdap - RDAP client, creation date and registrar extraction.
- score - risk scoring and verdict mapping.
- report - human, JSON, scale, and verbose renderers.
- main - CLI entry point and fetch orchestration.