We’re in a strange place online where scam and legit links often look identical in their infrastructure and behavior. Fast development cycles, missing headers, lazy security configs, it’s hard to tell who’s careless and who’s malicious.

Even well-known websites ship with broken HTML, sketchy inline scripts, missing HSTS, or sloppy cookies.

That makes it harder for everyone, tech-savvy or not, to assess whether an unknown link is safe, especially with AI-generated scams on the rise, e.g., trap page —> auto-redirect stray clicks to legit site.

I built LegitURL to reveal subtle signals that might otherwise go unnoticed.

What it does:

LegitURL (Swift / iOS, open-source): – Runs offline: parses URL components, flags homograph attacks, entropy spikes, scammy terms – Sends a single stripped GET request (no cookies, no query) to analyze: – Silent or shady redirects (even without a Location header) – TLS cert sanity (CN/SAN match, freshness, sketchy intermediates) – Missing, broken, or contradictory CSP/HSTS headers – Cookie flags, expiry, tracking IDs – HTML structure: stripped comments, <script> tag analysis

All signals are shown transparently. You can export a PDF for humans or a JSON report for LLMs.

It’s not a malware detector or blacklist checker, it’s a structural/behavioral analyzer.

Fully on-device. Most links resolve in under 2s depending on latency.

Links – GitHub (repo + GIF demo): https://github.com/sigfault-byte/LegitURL – App Store (free / no-account): https://apps.apple.com/fr/app/legiturl/id6745583794

Still a WIP, some heuristics need tuning and edge cases are being discovered.

Would appreciate any feedback: – Are any signals missing or too strict? – UI ideas or improvements?

Thanks.