Snell13 analysis layers

Is it a scam,
or not?

Paste a text message, a link, a phone number or an IBAN — or drop a file.

Idle
Essayez

Le fichier déposé est lu, jamais exécuté — et ses octets ne sont pas conservés.

13 layers, 13 different questions

none decides alone

Shape

40 ms
  • Rules
  • Typosquat
  • N-grams
  • File
  • Hash

Databases & identity

400 ms
  • Databases
  • RDAP
  • Certificates
  • Model

Render

3 s
  • Sandbox

Correlation & judgement

6 s
  • Correlation
  • Judge
  • Analyst

The track marks when each stage answers, across the six seconds of the nominal path. The verdict appears at the first one, then updates — which is why it is labelled provisional while a layer is still running. Correlation has no schedule: it speaks as soon as a link appears.

What each layer establishes — and what it cannot
Deterministic rulesdoes the shape give it away?
Address structure (bare IP, punycode, fake authority before an “@”, unusual port, subdomains, path), the mod-97 check digits of an IBAN, the Arcep range of a phone number, known SMS patterns.
It does not know whether the domain exists, nor what the page contains.
Typosquat enginedoes this name imitate another?
Homoglyphs, typos, added suffixes, mixed scripts, a brand demoted to a subdomain — and the comparison of the received name against the real one.
It only knows the brands in its reference list: a name that imitates nothing is not honest for that reason.
Character modelis this run of letters plausible?
The likelihood of the raw character sequence of the name, learned from real domains. This is what catches machine-generated names whose every measured trait is otherwise unremarkable.
It reads the name and nothing else. A well-named malicious domain escapes it entirely.
Static file analysiswhat is this file, really?
The REAL type read from the bytes and checked against the declared extension, the structure of the format (PE header, Office macro, archive index, PDF keywords), commands written in clear text, and the indicators it carries — URLs, exfiltration tokens, bank accounts.
The file is never executed: what it would do once launched stays out of reach. Encrypted content — a password-protected archive, a packed section — is opaque, and finding nothing in it does not mean there is nothing.
Hash readingwhat does this digest say about itself?
The algorithm used, its strength, and membership of a handful of notable values — empty file, EICAR test file.
Almost nothing, and that is the whole point: a digest carries no information about the file. Everything that follows comes from databases, or from an analysis already performed on the content itself.
Indicator and legitimacy databaseswho has already reported it, or vouched for it?
The cross-check against everything ingested continuously: threat lists, registries of public-sector and heavily visited domains, already-named campaigns, siblings already known.
A database only knows the past. A domain registered this morning is not in it, and its absence does not clear it.
RDAPhow long has this domain existed?
Registration date, registrar, IP addresses and name servers — enough to tell a ten-year-old domain from a ten-hour-old one.
Many registries have published nothing since the GDPR: silence here is common and does not mean “clean”.
Certificate Transparencywhen was its first certificate issued?
The date of the first publicly known certificate: a floor on the domain's age that holds even when the registry says nothing.
It dates the first time the domain went live, not its registration — a domain left dormant for years looks “new” here.
Learned modelwhat do already-decided cases look like?
A probability and its contributions, computed from measured traits — length, entropy, age, campaign cohesion — against cases that have already been labelled.
It stays silent while no trained artefact is loaded, and can never carry a verdict on its own.
Sandbox renderwhat does the page actually show?
An isolated browser opens the address behind a mediating proxy: real redirects, forms asking for a password or a card, third-party scripts, exfiltration endpoints, fingerprints of the kit.
A site that is offline, or that refuses the visit, produces nothing — and a page can behave differently depending on who is looking.
Correlationis this an isolated case?
Pivots link items to one another — same kit, same collection endpoint, same hosting, same registration burst — and group them into named campaigns.
An isolated item is the ordinary case: being linked to nothing is not a good sign, it is an absence of neighbours.
AI judgewhat does the review conclude?
A review of everything the other layers established, including the visible text of the page: scam family, targeted brand, advice in plain language.
It can only HARDEN the verdict, never soften it — and without a configured key it returns no opinion at all.
Analyst agentwhat does all of this mean?
The recomposition of every finding into a readable report: what is established, what is still missing, and the matching ATT&CK techniques.
It invents no finding and touches no verdict: it only composes what the others produced.

Error budget, by kind of error

15×more tolerance for missing than for accusing

  1. False positives — accusing something honest1 %
  2. False negatives — letting a scam through15 %

Enforced before every merge: if a change raises the false-positive rate it is rejected — even when it catches new scams.

What Snell does not claim

“Legitimate” is not a guarantee
Nothing we know how to check is wrong. A clean site can be compromised an hour later.
Silence is not evidence
A layer with nothing to say is shown as silent, never as a green light.
Nobody vouches for a phone number
No registry attests that a number is legitimate. Snell explains the mechanism instead of ruling.

Ce que la plateforme sait aujourd'hui

Observations ingested

all sources, since day one

Sources producing

the others have no key, or answer on demand

Kits catalogued

public registries, harvested daily

Active items

last hour

Campagnes

24 heures, trois membres minimum

No first verdict

arrived through a feed, never analysed

Render, median time

sandbox, last hour

Renders completed

last hour, refusals included

Le détail de l'ingestion est sur la page des indicateurs, la carte complète du modèle et la santé de la chaîne sur modèle & santé.