- Trust score
- TrustSniffer's 0 to 100 assessment of a website, calculated by fixed rules from the evidence collected when the site was analysed. Higher is better.
What the score is, and what it is not
A trust score is an assessment of risk from the evidence we could collect on the day we analysed a site. It isn't a guarantee that the site is safe, and it isn't a legal finding that it's fraudulent; every report says so. The reasoning behind the number is published with it, free to read, with no account needed, and you can download the whole report as a PDF. The score lands in one of four bands:
- High trust, 75 to 100. The evidence points to an established, accountable site.
- Moderate, 50 to 74. Nothing alarming, but gaps worth checking before you pay or sign in.
- Low, 25 to 49. Several warning signs. Verify the site independently first.
- Critical, below 25. Serious risk signals. Avoid paying, logging in or connecting a wallet.
Higher is better on this scale. Our wallet risk score runs the opposite way, with 100 as the riskiest, so the two shouldn't be compared.
Step one: collecting the evidence
A safety check runs before anything else. It follows the address through its redirects, refuses anything that points into a private network, and flags international domain names built to look like a familiar one. Then the evidence collectors run side by side, each covering one part of the picture:
- The page. A browser loads the site and records what it shows: the text, links and forms (including login and password forms), trackers, crypto vocabulary, signs of a parked or for-sale domain, and cues that it imitates a known brand.
- Behaviour. A second browser clicks, scrolls and submits forms, watching for things that only appear on interaction: wallet signing requests that could drain funds, code that swaps a copied wallet address, content that changes between desktop and phone, password forms that post somewhere else, and hidden downloads.
- History. The Internet Archive record shows how long the site has really been live, whether it went dormant, and whether an old domain was bought and turned into something else.
- Infrastructure. The registration record, DNS, hosting network, server country, certificate and lookalike spellings of the name.
- Outside reputation. Google Safe Browsing, VirusTotal, the reputation of the hosting IP, phishing signatures and popularity rankings.
- Recognition for finance sites. Whether the exact domain is the official site of a DeFi protocol that independent trackers follow, and whether it matches a registered forex or CFD broker.
Not all of this counts equally. Infrastructure oddities, for example, are treated as weak supporting evidence and capped as a group, because plenty of honest sites run on cheap hosting behind a privacy-protected registration.
Step two: turning evidence into a score
The collectors' output becomes a set of facts about the site, and documented rules read those facts. Some rules add trust: a long, unbroken history, real popularity, a recognised brand, visible accountability, a verifiable licence. Others take it away: a security listing, phishing patterns, wallet-draining scripts, a password form that posts to a different site, investment promises such as guaranteed returns on a deposit, or an aged domain that has been bought and repurposed.
Two design choices keep this fair to honest sites. Related warning signs are grouped and capped, so a heap of small, connected issues can't bury a legitimate business. And missing data doesn't count as wrongdoing: when a check can't run, it lowers our confidence in the result, not the score itself.
Step three: the hard limits
Some facts should settle the outcome whatever else is true, so a set of limits applies after the rules have added everything up:
- A confirmed outside listing. If Google Safe Browsing or another top-tier security source confirms the site as a threat, the score is held at 5 or below.
- An active malware or phishing listing, applied last. If the site itself is the threat, the score can't go above 5. If a legitimate site has been hacked, or we can't tell which it is, the limit is 45, and the report carries a notice that the owner may be a victim rather than the culprit.
- Investment-fraud patterns. Fixed high returns paid on a deposit, the classic Ponzi shape, hold the score at 35 or lower. Established, regulated finance and recognised DeFi protocols can be exempt.
- Sensitive forms with no accountability. A login page, payment form or wallet connection on a site that says almost nothing about who runs it is held at 45.
Limits also work in the other direction. A domain that independent sources recognise as an established brand or business, a verified government or university site, or a DeFi protocol tracked at scale can't fall below a set minimum. That protection switches off as soon as any independent warning sign appears, because someone who buys an expired, well-known domain shouldn't inherit its reputation.
When there isn't enough evidence
Some sites block automated visitors, sit behind a challenge page, or have almost nothing on them. Scoring those would mean guessing, so we don't. The report is published as Needs Review, without a score, and a site is never labelled Critical just because we couldn't see in. The exception is a confirmed outside threat: a site that blocks us but is listed for malware keeps its red result.
Every report also shows a confidence level, which reflects how much of the evidence we managed to collect. It sits beside the score and doesn't change it.
Where AI is used, and where it isn't
The arithmetic, the limits and the band are deterministic: the same evidence gives the same result every time. AI models help in narrower places. One reads the page and classifies what kind of business it presents itself as, and that classification feeds the rules. Another can switch off a short, fixed list of harmless noise signals in the behaviour check. Neither can switch off a security signal, and when a model fails, nothing is suppressed.
The written analysis in each report comes from a language model after the score is final, working from the scored evidence, so it explains the number instead of setting it. A report without its written analysis isn't published as final.
How the scores fall
As of 8 October 2026, 5,539 websites have a published TrustSniffer report. Of those, 3,298 (60%) scored High trust, 593 (11%) Moderate, 420 (8%) Low and 1,198 (22%) Critical, and 30 were published as Needs Review. The mix reflects what was submitted, from people's own checks to sites we analyse ourselves, so it says nothing about the web as a whole. The Risk Index carries the current figures, and every published report is listed in our directory.
How fresh a score is
A published report is reused for up to three months, so a second request in that window shows the same analysis with its date. After that, a new request runs a fresh analysis. A Needs Review result is never reused: the next request analyses the site again. When we correct a scoring rule, existing reports can be re-scored from the evidence already collected, and the reason is recorded.
What we leave out on purpose
Reports don't show the name or details of whoever registered a domain, even when the registration record contains them. We also don't publish each rule's weight. The findings section tells you, in plain English, what decided a site's score; the exact arithmetic would mostly help someone trying to game it.
If you think a report is wrong, our corrections page explains how to tell us, and the methodology page summarises the method in one place. To see the score in use, read how a scam website checker works or run a site through the website checker.
