How the score works
60% for the services, 25% for the community, 15% for the AI. Here is why.
Every page shows a score from 0 to 100 and a verdict. It mixes three sources, namely the security services, the community and the AI. Here is how, with no hidden formula.
The services count for 60%
Each service answers Malicious, Suspicious, Harmless or Undetected. Only the first three answers are opinions, because "Undetected" only means the service does not know the link or the file. A service that is unavailable does not count either.
Each opinion becomes a score out of 100, then we take the average. VirusTotal, which gathers dozens of antivirus engines, counts twice. CIRCL hashlookup, MalShare, AbuseIPDB and IPWhois.net count half.
The Safe or Nah votes of the accounts count from 5 votes. A vote counts once the account is 7 days old on the site, or at once if its GitHub account is over 30 days old. The score is simply the share of Safe votes. A review hidden by the moderators or written by a suspended account no longer counts.
The AI counts for 15%
A Safe review is worth 85, Meh 55 and Nah 15. The less sure the AI is, the closer its score gets to 50. It keeps its whole gap with a high confidence, three quarters with a medium confidence and half with a low confidence.
The AI review is only a hint. It can be wrong, and it counts for only 15% of the score.
When a source is missing
The weights are shared between the sources that are there. Without votes nor an AI review, the services make 100% of the score. With the services and the AI only, it is 80% and 20%. And if no service has an opinion, the verdict is "Unknown", because we would rather say nothing than guess.
The safeguards
- As soon as one service finds the link or the file malicious, the score cannot go above 39, so it is Nah, whatever the others say.
- As soon as one service finds it suspicious, the score cannot go above 69. AbuseIPDB and IPWhois.net are the exception, because they judge the IP address of the server, often shared by thousands of sites. AlienVault OTX too, because any account can publish a report there.
- If a service was not waited for during the first analysis, the score cannot go above 69.
- A Google Safe Browsing warning is no longer shown after 30 minutes, but it counts in the score until Google changes its mind. We ask again when you open the page.
The verdict
From 70 to 100, it is Safe. From 40 to 69, it is Meh. From 0 to 39, it is Nah. The score is computed again with every new vote and every new answer from a service, and the "Score calculation" tab of each page shows the details.