Methodology & data sources
Last updated:
This page explains where Raccoon gets its data, how it combines it, and what the tool cannot do — so you know how much weight each result deserves.
Data sources
| Source | Used for |
|---|---|
| WHOIS / RDAP, DNS | Registration date, registrar, name servers, IP address and hosting provider — to find where a report should go. |
| VirusTotal | Verdicts from many security scanners on a domain or URL. |
| Google Safe Browsing | Whether Google flags the page as phishing or malware. |
| URLhaus (abuse.ch) | Known malware distribution URLs reported by the community. |
| Spamhaus | Whether a domain or IP is on a blocklist. |
| urlscan.io | Opening the page in an isolated sandbox to record redirects, credential forms and downloads. |
| Search results | Watching page 1 of search results for brand keywords to spot unknown domains. |
| Cloudflare API | Reading and creating redirects and canonicals on the Cloudflare account the user connects. |
Some sources only work when the server has the matching API key. When a key is missing, the interface says “not configured” instead of showing an assumed result.
How risk is assessed
- Collect information from the sources above for each domain or URL.
- Compare signals: newly registered domain, name close to the brand, login form, unusual redirects, already flagged elsewhere…
- Score how suspicious it is and show each signal alongside, so you can see why a page scores high or low.
- The user reviews before any report is sent. Raccoon never accuses or reports on its own without confirmation.
Limits to keep in mind
- The risk score is a suggestion, not a legal finding. A brand-new site may not be in any source yet.
- Results depend on third-party data at the time of the lookup and can change afterwards.
- Takedown decisions belong to the registrar, host or platform receiving the report — Raccoon cannot guarantee a takedown.
- Redirect and canonical checks reflect what the server returned at that moment; caching can change what you see for a few minutes.
Changes to this methodology
When we add or remove a data source or change how results are assessed, this page is updated and the date at the top changes. Feedback on accuracy: [email protected].