How IncogSay Works

1. URL Submission & Client-Side Sandbox

When you paste a link into IncogSay, the query is received inside an isolated memory sandbox. Your browser never initiates a direct HTTP connection to the destination URL, preventing drive-by malware downloads, IP tracking, or fingerprinting attacks.

2. Recursive De-Cloaking & Redirect Chain Tracing

Shortened links (e.g. bit.ly, tinyurl.com, t.co) and tracking redirect parameters (?url=, ?target=, ?dest=, ?redirect=) are unwrapped across up to 10 sequential hops. You see every intermediate server, HTTP status code (301, 302, 307, 308), and final landing URL.

3. Unicode Homograph & Typosquat Detection

Scammers often substitute Latin characters with visually indistinguishable Cyrillic, Greek, or Hebrew code points (IDN spoofing like pаypal.com). IncogSay checks every domain label against internationalized character tables to flag mixed-script attacks instantly.

4. Shannon Entropy & DGA Analysis

Domain Generation Algorithms (DGAs) frequently used in command-and-control (C2) botnets create hostnames with high character entropy (e.g., xj89q-k1m99.xyz). IncogSay computes mathematical Shannon entropy $H(X) = -\sum p(x_i) \log_2 p(x_i)$ to detect algorithmic generation.

5. Live DNS, RDAP & Email Authentication Probing

IncogSay executes real-time DNS over HTTPS (DoH) queries against Cloudflare's 1.1.1.1 authoritative resolvers to inspect:

• SPF (Sender Policy Framework): Checks v=spf1 rules, IP mechanisms, and lookup limits.
• DKIM (DomainKeys Identified Mail): Validates public key selectors for cryptographic email signatures.
• DMARC (Domain-based Message Authentication): Evaluates p=reject, p=quarantine, and reporting tags.
• BIMI (Brand Indicators): Validates SVG brand logos and VMC certificates.
• Domain Age (RDAP): Calculates registration age and registrar registry timestamps.

6. Zero Data Persistence Model

Unlike search engines or corporate security monitors, IncogSay operates under a strict Zero-Trust & Zero-Persistence Guarantee:

• No database writes or disk storage.
• No query logs or IP tracking.
• No tracking cookies or telemetry beacons.

For complete technical specifications, mathematical scoring models, and RFC protocols, explore our Security Architecture Guidelines →