Security Architecture Guidelines

Overview

IncogSay operates as a single Cloudflare Worker — a JavaScript isolate running at Cloudflare's global edge network. All analysis is performed in CPU memory with zero external API calls, zero database writes, and zero data persistence.

The engine runs sequential detection phases, each contributing to a final 0–100 weighted risk score. Results are computed and returned in under 50ms globally.

Phase 1 — Recursive De-Cloaking & De-Tracking

URLs are preprocessed to strip telemetry parameters and recursively unwrap redirect chains before analysis.

Tracking Parameter Stripping

A regex pattern matches and removes all common tracking tokens:

// Stripped parameters include:
utm_source, utm_medium, utm_campaign, utm_term, utm_content
fbclid, gclid, twclid, msclkid
_ga, _gl, mc_cid, mc_eid, igshid, mkt_tok ...

Recursive Redirect Resolution

A loop (max depth: 5) extracts targets from redirect parameters:

// Redirect parameters inspected:
?url=, ?redirect=, ?next=, ?goto=, ?target=, ?u=,
?link=, ?return=, ?returnurl=, ?forward=, ?dest=

Each iteration also checks for:

URL encoding layers

Repeated decodeURIComponent() unwrapping until no further URL transformations exist.

Base64-encoded paths

Path segments matching /^[A-Za-z0-9+/]{20,}={0,2}$/ are decoded and tested for embedded destination URLs.

Phase 2 — Cryptographic Homograph & Punycode Detection

Homograph attacks exploit visual similarity between characters from different Unicode scripts to impersonate trusted domains.

Punycode Detection

Each domain label is inspected for the xn-- Internationalized Domain Name (IDN) prefix. Any such label is flagged as a candidate for homograph inspection.

Mixed Script Detection

The engine uses Unicode code-point ranges to detect multi-script mixing:

CYRILLIC: /[\u0400-\u04FF]/
GREEK:    /[\u0370-\u03FF]/
HEBREW:   /[\u0590-\u05FF]/
ARABIC:   /[\u0600-\u06FF]/

// If LATIN characters co-exist with any of the above
// in the same label → HIGH SEVERITY Homograph flag

Example attack: pаypal.com — where the "а" is Cyrillic U+0430 (looks identical to Latin "a").

Phase 3 — Shannon Entropy & DGA Detection

Domain Generation Algorithms (DGAs) produce hostnames with high character randomness. Shannon entropy quantifies this randomness mathematically.

Shannon Entropy Formula

Implementation

function shannonEntropy(str) {
  const freq = {};
  for (const ch of str) freq[ch] = (freq[ch] || 0) + 1;
  const len = str.length;
  let H = 0;
  for (const count of Object.values(freq)) {
    const p = count / len;
    H -= p * Math.log2(p);
  }
  return H;
}

DGA Classification Threshold

A domain is flagged as a likely DGA-generated hostname when:

Entropy H(X) > 4.2 bits

Indicates high character randomness and unpredictable structural patterns.

Hostname length > 14 characters

The typical character volume required to evade standard DNS denylists.

Additionally, subdomain stacking is penalised: 3 or more subdomain layers (e.g., login.secure.bank.evil.com) adds to the risk score to catch deceptive subdomain-based cloaking.

Phase 4 — Dynamic Weighted Risk Scoring

All detected signals are aggregated into a 0–100 risk score using a multi-factor penalty system:

Verdict Thresholds

0–30: ✓ Clean

No significant threat indicators. Standard traffic routing.

31–69: ⚠ Suspicious — High Caution

Multiple weak threat signatures identified. Proceed carefully.

70–100: ✕ Dangerous — Threat Confirmed

Strong heuristic overlap with known credential harvesting or malware vectors. Do not proceed.

DNS Validation & Email Trust Suite (SPF, DKIM, DMARC, BIMI)

Our Cybersecurity Suite performs real-time verification of email authentication protocols via Cloudflare's DNS-over-HTTPS (DoH) API, executing sandboxed inspections without caching or logging records.

Phase 1: Sender Policy Framework (SPF) Parsing

We query the target domain's TXT records, isolating SPF descriptors starting with v=spf1. The analyzer checks policy constraints:

Hardfail (-all) / Softfail (~all)

Indicates the policy strictness for unauthorized mailservers attempting to inject spoofed mail.

Lookup Count Limit

Validates that the record doesn't exceed the RFC-specified limit of 10 DNS queries, which can cause validation timeouts.

Dangerous Wildcards (+all)

Flags highly critical configurations that allow any IP address to spoof the domain entirely undetected.

Phase 2: Domain-based Message Authentication (DMARC) Enforcement

Queries spoof-prevention rules at _dmarc.[domain]. The engine parses compliance policies (p=reject|quarantine|none) and evaluates whether aggregate reports (rua=) are directed to active monitoring systems. If the policy is set to reject or quarantine, it enforces strict verification status. If it's missing or set to none, the domain is vulnerable to email spoofing.

Phase 3: DomainKeys Identified Mail (DKIM) Selector Validation

Queries cryptographic public key records at [selector]._domainkey.[domain], parsing tags like k= (key type) and p= (public key string) to evaluate cryptographic key strength (RSA 1024-bit vs 2048-bit). This ensures that email signatures are mathematically verified by mail servers.

Phase 4: Brand Indicators for Message Identification (BIMI) SVG Verification

Probes default._bimi.[domain] to retrieve Verified Mark Certificates (VMC) and official SVG brand logos, validating HTTPS resource paths and format compliance. To protect recipient privacy and prevent cross-site scripting (XSS), the SVG asset is safely resolved and displayed directly via standard secure image bindings, rather than injecting unverified SVG source code.

Performance & Efficiency

The engine is designed for ultra-low latency edge execution:

Sub-millisecond processing

All patterns, regex, loops, and entropy calculations are fully optimized for Edge V8 isolates.

Minimal footprint

Executes using lightweight, memory-efficient string matching and targeted heuristics.

Parallelized verification

Live DNS queries and pattern scans are run concurrently using asynchronous promise execution.

Max redirect depth: 5

Prevents infinite redirect loops and malicious nesting attacks from consuming compute time.

Zero-Trust Model

IncogSay implements a Zero-Trust privacy model:

No data retention

URLs are processed in memory and are never written to physical storage or databases.

No logging

Request logs are structurally dropped and are not captured at the application layer.

No authentication required

The tool is anonymous by design, requiring zero account binding.

Edge-only compute

Analysis executes in Cloudflare Workers isolates and never traverses to origin servers.

TLS everywhere

All traffic is strictly encrypted in transit via forced HTTPS.

Phishing Analysis: What It Is & How It Works

Phishing analysis is the process of examining a URL, email, or web page for indicators of a phishing attack. A phishing analysis tool like IncogSay automates this process, applying multiple detection phases to surface malicious signals that aren't visible to the naked eye.

Phishing Analysis Fundamentals

The core phishing analysis fundamentals include:

URL decomposition

Breaking the URL into protocol, domain, subdomain, path, and parameters to isolate structural anomalies.

Domain mimicry detection

Calculating Levenshtein distance scoring against an active matrix of 200+ high-value brand names.

Redirect chain unwrapping

Recursively unwrapping forwarding layers to expose the true final destination of the payload.

Entropy analysis

Executing Shannon's entropy formula to mathematically detect algorithmically-generated domain names (DGAs).

Infrastructure probing

Querying live DNS MX record checks to identify unverified, spoofed, or newly-registered domains.

Phishing Analysis vs. Phishing Simulation Tools

While phishing simulation tools (used in security awareness training) create fake phishing emails to test employees, a phishing detection tool like IncogSay performs defensive phishing analysis — examining real suspicious URLs to determine if they are malicious. IncogSay is the best free phishing detection tool for this defensive use case.

URL Scanner & Phishing Analysis in Cyber Security

In cyber security, phishing analysis tools are used by SOC analysts and blue teamers to triage suspicious URLs from phishing emails, smishing messages, and QR codes. Our URL scanner provides the same multi-layer phishing analysis workflow — including homograph checks, entropy scoring, and TLD risk matrix evaluation — as enterprise-grade tools, completely free.