199 lines
8.1 KiB
Markdown
199 lines
8.1 KiB
Markdown
# isthislegit? [v1.01]
|
||
|
||
Domain Impersonation & OSINT Triage Tool.
|
||
|
||
`isthislegit` compares a known-legitimate domain (target) against a suspect
|
||
domain using DNS resolution, X.509 TLS certificates, and RDAP registration
|
||
data to produce a deterministic risk score and verdict. DNS answers are
|
||
cross-checked across the system resolver, 1.1.1.1, and 8.8.8.8 for
|
||
split-brain or hijacking signals (state consistency only — raw addresses
|
||
are never compared, so CDN/GeoDNS fronting stays quiet). Each unique
|
||
domain is probed once and the outcomes reused; even identical
|
||
target/suspect pairs run the full pipeline (verdict forced to legitimate).
|
||
System-dark/public-live suppression splits score on the suspect, while
|
||
split-horizon shapes stay display-only. It ships as a single
|
||
static binary built on the Go standard library (plus `golang.org/x/sync` for
|
||
the concurrent fetch pipeline) — no `curl`, `openssl`, `jq`, or `dig`
|
||
required.
|
||
|
||
## Features
|
||
|
||
- **DNS pre-flight** — NXDOMAIN / unresolvable domains abort early.
|
||
- **X.509 classification** — leaf certificate issuer, SANs, and validation
|
||
level (EV / OV / IV / DV) from CA/Browser Forum policy OIDs.
|
||
- **RDAP triage** — creation date and registrar via `https://rdap.org/domain/`.
|
||
- **Deterministic scoring** — transparent point system with a four-tier verdict.
|
||
- **Flexible output** — human-readable report, `--json` for scripting,
|
||
`--verbose` for raw OIDs, cert details, and RDAP payloads.
|
||
|
||
## Prerequisites
|
||
|
||
- Go 1.24 or newer.
|
||
- Network access to DNS, remote port 443, and `rdap.org`.
|
||
|
||
## Clone, build, run
|
||
|
||
```bash
|
||
git clone https://github.com/example/isthislegit.git
|
||
cd isthislegit
|
||
CGO_ENABLED=0 go build -ldflags="-s -w" -o isthislegit ./cmd/isthislegit
|
||
./isthislegit jdsoft.com jdsoftcareers.com
|
||
```
|
||
|
||
Run the test suite with:
|
||
|
||
```bash
|
||
go test ./...
|
||
```
|
||
|
||
### Cross-compiling with compile.go
|
||
|
||
`compile.go` (repo root) is the supported build driver. It cross-compiles
|
||
`./cmd/isthislegit` for a platform/arch matrix, always with
|
||
`CGO_ENABLED=0`, so every target builds without a cross C toolchain:
|
||
|
||
```bash
|
||
go run ./compile.go --platform=linux --arch=amd64
|
||
```
|
||
|
||
| Flag | Default | Description |
|
||
|--------------|---------|----------------------------------------------------------|
|
||
| `--platform` | `linux` | Target OS (see vocabulary below). |
|
||
| `--arch` | `amd64` | Target arch (see vocabulary below). |
|
||
| `--static` | `true` | `true` for static (`CGO_ENABLED=0`), `false` for dynamic (`CGO_ENABLED=1`, host builds only unless `CC` points at a cross compiler). Both modes are stripped via `-ldflags="-s -w"`. |
|
||
|
||
Platform vocabulary (case-insensitive): `linux`; `mac`/`macos`/`osx`/`darwin`
|
||
→ `darwin`; `windows`/`win` → `windows`; `bsd` → all three of `freebsd`,
|
||
`openbsd`, `netbsd` in one run (or name a single BSD explicitly).
|
||
|
||
Arch vocabulary: raw `GOARCH` names plus aliases — `x64`/`x86-64` → `amd64`;
|
||
`x86`/`i386`/`32bit` → `386`; `aarch64` → `arm64`; `arm`/`armv7`/`armv6`/`armv5`
|
||
→ `arm` with matching `GOARM`. Unknown values exit 1, and combos the
|
||
toolchain does not support (e.g. `darwin/386`) are refused with a clear
|
||
error.
|
||
|
||
Output binaries are named `isthislegit-<goos>-<goarch>` (with a `vGOARM`
|
||
suffix when applicable, e.g. `isthislegit-linux-armv7`, and `.exe` on
|
||
Windows):
|
||
|
||
```bash
|
||
go run ./compile.go --platform=linux --arch=amd64
|
||
go run ./compile.go --platform=windows --arch=x64 --static=false
|
||
go run ./compile.go --platform=bsd --arch=x64
|
||
go run ./compile.go --platform=linux --arch=armv7 # embedded ARM (Miyoo Mini Plus)
|
||
```
|
||
|
||
## Flags
|
||
|
||
| Flag | Description |
|
||
|-----------------|---------------------------------------------------------------|
|
||
| `-v, --verbose` | Append raw cert policy OIDs, TLS details, and RDAP JSON. |
|
||
| `-j, --json` | Output the result summary as JSON for scripting. |
|
||
| `-k, --insecure`| Skip TLS verification for RDAP |
|
||
| `--timeout=DUR` | Per-call deadline for DNS/TLS/RDAP (Go duration, default 5s). |
|
||
| `--scale` | Print the scoring scale reference table and exit. |
|
||
| `-h, --help` | Display usage and exit. |
|
||
|
||
Examples:
|
||
|
||
```bash
|
||
isthislegit jdsoft.com jdsoftcareers.com
|
||
isthislegit -j example.com suspect-example.com
|
||
isthislegit --timeout=10s example.com suspect-example.com
|
||
isthislegit --scale
|
||
```
|
||
|
||
### Embedded systems (no CA certificates)
|
||
|
||
`isthislegit` runs on embedded ARM devices (verified on a Miyoo Mini Plus),
|
||
but minimal firmware images often ship without a CA certificate store. In
|
||
that case DNS resolution and certificate inspection still work, while
|
||
verified HTTPS (RDAP) fails — the fail-closed error will say so directly
|
||
(`x509: certificate signed by unknown authority`). Prefer installing
|
||
`ca-certificates` and fixing the system clock where possible; otherwise use
|
||
insecure mode:
|
||
|
||
```bash
|
||
isthislegit -k jdsoft.com jdsoftcareers.com
|
||
```
|
||
|
||
`--insecure` prints a warning and weakens results, so treat it as a last
|
||
resort for devices without stored CA certificates.
|
||
|
||
## Example output
|
||
|
||
```text
|
||
isthislegit? [v1.01]
|
||
Domain Impersonation & OSINT Triage Tool
|
||
|
||
[*] Comparing: example.com (Target) <---> example.org (Suspect)
|
||
|
||
[+] Target Domain: example.com
|
||
|-- Creation Date : 1995-08-14
|
||
|-- Registrar : RESERVED-Internet Assigned Numbers Authority
|
||
|-- Cert Issuer : SSL Corporation
|
||
|-- Validation : DV (Domain Validated)
|
||
|-- Cert SANs : example.com, *.example.com
|
||
|
||
[-] Suspect Domain: example.org
|
||
|-- Creation Date : 1995-08-31
|
||
|-- Registrar : ICANN
|
||
|-- Cert Issuer : SSL Corporation
|
||
|-- Validation : DV (Domain Validated)
|
||
|-- Cert SANs : example.org, *.example.org
|
||
|
||
----------------------------------------------------------------------
|
||
[!] RISK ANALYSIS (score: 30):
|
||
[!] MISMATCH: Registrars do not align (RESERVED-Internet Assigned Numbers Authority vs ICANN).
|
||
|
||
VERDICT: LIKELY UNRELATED / MISCONFIGURED
|
||
```
|
||
|
||
## Scoring scale
|
||
|
||
| Signal | Points |
|
||
|---------------------------------------------|--------|
|
||
| Suspect < 30d (CRITICAL), stacked w/ signal | +80 |
|
||
| Suspect < 30d (CRITICAL), isolated | +40 |
|
||
| Suspect 30–89d (WARNING), stacked w/ signal | +40 |
|
||
| Suspect 30–89d (WARNING), isolated | +20 |
|
||
| Shared cert infrastructure (halves age tier)| x0.5 |
|
||
| Identical target/suspect (forced LEGITIMATE) | +0 |
|
||
| Resolution tampering: suppression split (suspect) | +50 |
|
||
| DNS split-horizon / target-side (display only) | +0 |
|
||
| Cert downgrade: target EV/OV vs suspect DV | +40 |
|
||
| Registrar mismatch | +30 |
|
||
| Same-class issuer difference (display only) | +0 |
|
||
|
||
| Score | Verdict |
|
||
|-------|----------------------------------------|
|
||
| 0–14 | LIKELY LEGITIMATE |
|
||
| 15–39 | LIKELY UNRELATED / MISCONFIGURED |
|
||
| 40–50 | SUSPICIOUS — MANUAL REVIEW RECOMMENDED |
|
||
| 51+ | LIKELY PHISHING / IMPERSONATION ATTEMPT|
|
||
|
||
Lookups fail closed: if RDAP dates or TLS data cannot be retrieved for
|
||
either domain, the tool errors out instead of printing a verdict built on
|
||
missing data, and the message names the underlying cause(s) (e.g. a TLS
|
||
verification failure, which on minimal devices usually means missing CA
|
||
certificates or a wrong system clock). Fetches run concurrently under a
|
||
15s global budget with 5s per-call deadlines (3 attempts each, adjustable
|
||
via `--timeout`); `--insecure` skips RDAP TLS verification as a last
|
||
resort, with a warning.
|
||
|
||
## Project layout
|
||
|
||
```text
|
||
cmd/isthislegit CLI parsing, fetch orchestration, output dispatch
|
||
internal/dns Domain normalization, syntax checks, DNS pre-flight
|
||
internal/cert TLS leaf fetch and validation-level classification
|
||
internal/rdap RDAP client, creation date and registrar extraction
|
||
internal/score Risk scoring and verdict mapping
|
||
internal/report Human, JSON, scale, and verbose renderers
|
||
```
|
||
|
||
## License
|
||
|
||
Copyright (C) 2026 Mark Robillard Jr (MARKMENTAL). `isthislegit` is free
|
||
software licensed under the GNU General Public License v3 — see
|
||
[LICENSE](LICENSE) for the full text.
|