HECAVEXPublic threat radar
Menu

Methodology

How a signal reaches Radar

HECAVEX Radar is a passive, explainable screening pipeline for possible phishing and impersonation relevant to Lithuania. It favors precision over volume and never treats one automated signal as proof of malicious intent.

Pipeline

Four bounded stages

Every published row follows the same normalization, brand-scoping, safety, and merge path.

  1. 01

    Observe

    Read passive public observations from Certificate Transparency, existing public URLScan reports, and an optional configured HECAVEX export.

  2. 02

    Match

    Compare hostnames with a reviewed Lithuanian-brand registry while suppressing official domains and known lexical collisions.

  3. 03

    Validate

    Require one unambiguous brand, current evidence, safe fields, and the relevant confidence threshold before publication.

  4. 04

    Publish

    Defang accepted indicators, mark public observations as suspected, merge duplicate hosts, and write a static JSON snapshot.

Collection

Passive observations only

Radar does not browse a candidate host, submit it for scanning, or turn a defanged indicator into a live link.

Certificate Transparency

CertStream

Scheduled collection listens to live certificate events for four minutes per run, normally twice per hour. Each DNS name is scored independently and qualifying matches are stored in Europe/Vilnius daily archives.

That schedule provides at most 192 listening minutes per day, or 13.3% of wall-clock time. It is live sampling, not a daily certificate dump: events outside successful listening windows are not replayed or backfilled by the current collector. Actions can start late or fail, so actual observation can be lower.

Existing public reports

URLScan

Radar searches already-existing public results using exact candidate domains, reviewed brand terms, page titles, and tightly bounded primary-HTML SHA-256 pivots. It never submits a new scan.

Search summaries and result details must both report public visibility. URLScan can enrich CertStream with screenshots, hashes, and hosting metadata, but it is not required for a qualifying CertStream row.

Optional configured input

HECAVEX export

A deployment may configure a bounded HTTPS JSON export. Supplied source labels are ignored; accepted rows are attributed to HECAVEX and must pass the same brand, URL, timestamp, and evidence validation.

Internal collectors, proprietary detection logic, analyst notes, credentials, and private historical data are outside this public project and its data contract.

Brand matching

Conservative by construction

The public registry records reviewed aliases, fuzzy aliases, official domains, exclusions, and collision terms for brands relevant to Lithuania. Registry entries cannot supply executable regular expressions.

  1. 01

    Normalize the hostname, then reject malformed input, reviewed official domains, excluded domains, and their subdomains.

  2. 02

    Match an alias as a complete hyphen-delimited token or complete token sequence within one DNS label. Suspicious context must normally occur in that same label.

  3. 03

    Allow narrowly joined forms such as a reviewed suspicious prefix or suffix attached directly to a sufficiently long brand alias.

  4. 04

    Apply opt-in restricted Damerau–Levenshtein matching only to reviewed single-word fuzzy aliases, with the same suspicious-context requirement.

  5. 05

    Reject excluded terms, multi-brand evidence, and any declared brand that conflicts with the current hostname match.

Scoring threshold

Different top-level domains, multiple hyphens, suspicious words, and punycode can increase a score only after valid brand evidence exists. The default CertStream and URLScan domain threshold is 80/100.

Publication

What the dashboard exposes

The hourly publisher revalidates recent archives against the current registry, merges compatible observations, limits output, and atomically replaces one static snapshot.

Indicator
A normalized, defanged domain or URL. Credentials, query strings, fragments, and unsafe path data are removed.
Timeline
First-seen and last-seen timestamps from accepted observations, normalized to UTC.
Source
CertStream, URLScan, or a configured HECAVEX public export. Multiple observations can merge into one host row.
Status
CertStream and URLScan rows remain suspected. Active, offline, or mitigated lifecycle states require a configured HECAVEX observation.
Target
Exactly one brand resolved through the current reviewed registry and collision checks.
Evidence
Optional URLScan report, screenshot, primary-document SHA-256 hashes, host summary, and country metadata.
Confidence
An integer ranking score from 0 to 100. It orders evidence strength; it is not a probability or verdict.
Merge behavior

One row represents one observed host. Merging keeps the earliest first-seen value, latest last-seen value, union of sources and hashes, most specific safe path, and highest confidence. Conflicting non-null brands invalidate the merged row.

Limits and safety

Read the signals as leads

Coverage gaps and missing enrichment are expected. Neither a listing nor an absence from Radar is a verdict.

Interpretation

A lead, not attribution

A row indicates possible phishing or impersonation. It does not prove malicious intent, current liveness, ownership, attribution, compromise, or that a person has interacted with the domain.

Coverage

Intentionally incomplete

CertStream is sampled rather than continuous, URLScan exposes only existing public reports, and some metadata is optional. Missing URLScan evidence does not make a candidate safe or prevent a CertStream candidate from appearing.

Browsing safety

Indicators stay defanged

The dashboard never links to observed hosts. Evidence controls can contact exactly urlscan.io after a user chooses to open them; report and screenshot URLs are validated before publication.

Corrections

Rules are re-applied

Archived observations are checked against the current registry during synchronization, so corrected brand mappings and official-domain additions remove stale false positives from later snapshots.

Service boundary

Best effort, no SLA

Radar is maintained public research. It is not continuous brand monitoring, victim notification, incident response, takedown, or an availability or response commitment.

Operational evidence

Snapshot state has limits

Source timestamps show archive reads performed by the publisher. The separate public collection-health document reports actual timing, aggregate counts, late starts, outcome, last success, and freshness for only the latest CertStream attempt; it is not evidence of continuous or replayable coverage.

Believe a listing is incorrect? Report a false positive.