Methodology · Scoring
How Authority and Safety are scored
Two separate assessments from the evidence available for a website: prominence and continuity for Authority; recorded threat, transport and email observations for Safety. We publish the model constants and identify missing inputs. When the evidence is thin, we say “not enough signals yet” — we never dress up ignorance as a low score.
Five design principles
A score is a posterior, not a sum
Checklist scorers add points for whatever they happen to see, so a site nobody has measured looks identical to a site measured and found empty. AboutUs treats every signal as evidence updating a prior belief. Missing evidence widens the uncertainty interval — it never silently scores as zero, and it never silently scores as fine.
Influence is proportional to the cost of faking
A factor's maximum weight tracks what it costs an adversary to forge it. Global popularity rank and years of corroborated history cost years and large sums to fake, so they dominate. A TLS certificate and clean email records can be configured in an afternoon, so they are worth a few points at most — real, but bounded.
Gates for facts, sums for degrees
A current threat-feed listing caps the Safety band. A registry hold is a mild operational signal, not a threat verdict. Other factors use the published model weights; the presence of a number is not a safety guarantee.
Every displayed point maps to a sentence
Authority reason lines explain the underlying model score. The public Authority figure is then mapped through a dated percentile table and capped at 99. Safety lists its contributing observations and available check coverage separately.
Correlated signals fuse before they weigh
Tranco rank, Open PageRank, and corpus link counts all measure the same thing — prominence. They combine into one factor before weighting, so being popular never counts three times.
The observation model
Observed, absent, or unknown — never conflated
Every signal enters the engine in one of three states. Observed: the check ran and returned a value. Observed-absent: the check ran and confirmed the thing is not there — absence is information, and it scores. Unknown: the check failed, was rate-limited, or is not yet wired — it carries zero weight, cannot help or hurt the score, and reduces usable evidence instead. An unknown measurement date never becomes a fresh check. Dated Authority inputs and non-current-event Safety hazards use the published exponential decay constants. A current threat listing remains subject to its source expiry/retraction policy; an expired result becomes unknown, not clean.
Authority
Five factor families, weighted by the cost of faking them
| Family | Weight | Signals (fused within the family) | Cost to fake |
|---|---|---|---|
| Prominence | 52% | Current display: Tranco rank and Open PageRank when dated observations are available. The model supports corpus inbound links, but this input is not currently passed by the public profile adapter. | $10⁴–10⁶ and months of sustained traffic to fake |
| Verified continuity | 30% | Current display: RDAP registration age when available. Independent archive/CT history and infrastructure timelines are supported by the model but are not wired into the shared public score. | Years — and the drop-catch rule breaks shortcuts |
| Identity corroboration | 4% | Registry identity match is not currently wired into the public score; the supported model contribution is capped at 4 points | A £12 shell company exists; that is why the cap exists |
| Security & email hygiene | 8% | TLS validity and maturity · DNSSEC · MX/SPF/DMARC. Additionally, broken HTTPS caps Authority at 85 — a ceiling, not a deduction | Nearly free to configure — hence a small, bounded block |
| Prominence × continuity | 6% | An interaction term rewarding sites that are both prominent and have been so for years | Requires both of the expensive things at once |
Verified-years: history that has to agree with itself
The model supports corroborating registry, archive, historical record and certificate dates. The shared public score currently supplies the available RDAP registration observation; the other historical inputs and archive timelines are not yet connected to this display path. Registration age is not proof of continuous operation by one business. The model's corroboration and reset rules are described separately. How we measure continuity →
Aggregation, calibration, and confidence
Within each family, evidence combines as a mass-weighted posterior shrunk toward a low prior — the null hypothesis is “not notable,” and thin evidence stays close to it. Families combine by the published weights, and a fixed monotone calibration map (anchored so that google.com = 99, an established corroborated business ≈ 87, a typical indexed site ≈ 40, a parked domain ≤ 6) turns the fused value into the model score. The Authority number published on a profile is that model score expressed as a percentile — the share of scored sites that fall below it — so a typical site reads near 50 rather than near 17. The ordering never changes, and the evidence panel on every profile still shows the reason lines that sum to the underlying model score. Because most scored sites cluster low, the percentile compresses at the very top: the strongest sites on the web all publish at the cap of 99. The percentile table was measured in August 2026; it is not a live percentile of every website. Authority evidence confidence is computed from total evidence mass: below 0.35 the score is withheld entirely (“not enough signals yet”), and above it the score ships with an uncertainty heuristic interval that narrows as evidence accrues. This interval has not been validated as a statistical confidence interval; rounded scores and lookup-table percentiles can tie.
Safety
A hazard model, not a checklist
Safety events group into six families — threat feeds, deception, commerce, infrastructure, transport, email hygiene. Within a family, the worst event dominates and the rest contribute a quarter of their weight (max-fusion: ten blacklists listing one IP is one fact, not ten). Family hazards sum into a total H, and Safety = 100 − 100·(1 − e−H), capped at 90. Non-current-event hazards decay with per-family exponential time constants, not half-lives. A current threat listing is retained until its expiry or a source retraction; an expired result no longer supports a current clean or harmful claim.
| Event | Severity (0–0.99) |
|---|---|
| Active threat-feed listing | 0.92 |
| Registry hold (operational status, mild) | 0.05 |
| Typosquat of a high-authority brand | 0.50 |
| Anomalous infrastructure change (corroborated) | 0.28 |
| Commerce claims without matching identity | 0.22 |
| Recorded HTTPS check did not confirm a valid connection | 0.16 |
| High-abuse TLD | 0.10 |
| No MX and no DMARC | 0.04 |
| Parking / for-sale nameservers (calibrated, see below) | 0.00 |
New is not unsafe — the invariant, made precise
Domain age contributes zero hazard. A two-month-old legitimate site with clean checks can reach the public cap of 90. But age multiplies independently-observed hazards in the deception families (×1.35 under 30 days, ×1.2 under 90, ×1.08 in the first year): new ≠ unsafe, but new + phishing evidence is worse than old + the same evidence.
Honest bands
The current model's “Clear” band can follow either a threat-feed check or a checked name-similarity heuristic. It does not require a complete threat scan. Each display therefore states which of those checks is available, alongside transport and email coverage. Hygiene alone reads “No known flags (partially checked).” A current feed hit gates “Known risk”; a sufficiently large combination of heuristic hazards can also reach that band. Safety has no calibrated high/medium/low confidence rating. Coverage is not a probability of safety.
What deliberately scores nothing
Restraint is part of the method
- Domain age by itself — new is not unsafe; age only amplifies independently-observed deception evidence
- Parking nameservers by themselves — measured 2026-09-10 against consulted harm sources: 2 of 1,144 parked delegations were flagged, the same rate as the population (0.15%), so the class carries 0 bits and is shown as a fact, not a penalty
- Claim status — whether an owner has claimed a page is a workflow state, not evidence about the website
- Breach-history mentions — shown as dated context in the record, never scored
- The wiki's historical self-descriptions — displayed as dated history (Lane P), never as current fact
- Popularity on AboutUs itself — self-reference is not evidence
Known limits
What this model cannot yet see
A site that serves our checks clean pages while serving victims something else (cloaking) defeats every content-derived negative; until fetch-diversity checks land, such a site reads “partially checked” — never “Clear.” A purchased aged domain that keeps its registrar and content continuity can survive the drop-catch rule. We monitor the score distributions themselves for drift, because any published score invites gaming — and we would rather document the limits than pretend they don't exist. Scores are statistical evidence summaries, not verdicts, warranties, or accusations; the evidence lines under every score are the product.
Authority evidence draws on Open PageRank link-graph data and the Tranco research ranking.