isthislegit? [v1.01]

Domain Impersonation and OSINT Triage Tool. Compares a known-legitimate domain (target) against a suspect domain using DNS resolution, X.509 TLS certificates, and RDAP registration data, then produces a deterministic risk score and verdict. Single static binary; standard library plus golang.org/x/sync only.

Build and Run

git clone https://github.com/example/isthislegit.git
cd isthislegit
CGO_ENABLED=0 go build -ldflags="-s -w" -o isthislegit ./cmd/isthislegit
./isthislegit jdsoft.com jdsoftcareers.com
go test ./...

Flags

Flag	Description
`-v, --verbose`	Append raw cert policy OIDs, TLS details, and RDAP JSON.
`-j, --json`	Output the result summary as JSON for scripting.
`-k, --insecure`	Skip TLS verification for RDAP (weakens results; last resort for devices without CA certificates).
`--timeout=DUR`	Per-call deadline for DNS/TLS/RDAP; Go duration, default 5s.
`--scale`	Print the scoring scale table and exit.
`-h, --help`	Display usage and exit.

Fetch Pipeline

Both domains are fetched concurrently with golang.org/x/sync/errgroup under a 15 second global deadline; each DNS, TLS, and RDAP call carries a 5 second deadline (adjustable with --timeout) and is retried up to 3 times. Total run time equals the slower of the two domains. Fail-closed errors name the underlying cause(s).

parse args --> DNS pre-flight (target + suspect, parallel)
           --> fetch target   = RDAP + TLS in parallel
           --> fetch suspect  = RDAP + TLS in parallel
           --> fail-closed verify --> score --> render

Exit codes: 0 on success (including --scale and --help), 1 on bad flags, invalid domains, DNS failure, or failed data-quality verification.

Embedded Systems

The tool runs on embedded ARM devices (verified on a Miyoo Mini Plus), but minimal firmware often ships without a CA certificate store. DNS and certificate inspection still work there, while verified HTTPS (RDAP) fails; the fail-closed error names the cause (x509: certificate signed by unknown authority). Install ca-certificates and fix the clock where possible, otherwise use -k/--insecure as a last resort.

Scoring Scale

Signal	Points
Suspect domain age < 30 days (CRITICAL)	+80
Suspect domain age 30-89 days (WARNING)	+80
Cert downgrade: target EV/OV vs suspect DV	+40
Registrar mismatch	+30
Same-class issuer difference (display only)	+0

Score	Verdict
0-14	LIKELY LEGITIMATE
15-39	LIKELY UNRELATED / MISCONFIGURED
40-50	SUSPICIOUS - MANUAL REVIEW RECOMMENDED
51+	LIKELY PHISHING / IMPERSONATION ATTEMPT

Packages

dns - normalization, syntax checks, DNS pre-flight.
cert - TLS leaf fetch and validation-level classification.
rdap - RDAP client, creation date and registrar extraction.
score - risk scoring and verdict mapping.
report - human, JSON, scale, and verbose renderers.
main - CLI entry point and fetch orchestration.