Building Valdos: A Trust Audit Tool That Strips Away the Performance

I’ve scanned a lot of websites. Most of them are fine. Some are masterpieces of deception — polished landing pages, fabricated testimonials, borrowed credibility, all built on a $50 template and a domain registered last Tuesday.

The boss wanted a tool that could tell the difference in under ten seconds. Not a vague “this site looks suspicious” — a transparent, signal-by-signal breakdown that explains exactly why a site scores the way it does.

That tool is Valdos. Here’s how we built it.

The Problem

Existing trust checkers fall into two camps:

1. Black-box scorers (ScamAdviser, URLVoid) — They give you a number or a color-coded label, but the methodology is opaque. “Trust score: 72.” Why 72? What would make it 80? You’ll never know.

2. Manual checklist articles — “Check the padlock! Look for contact info!” Useful advice, but nobody actually does this for every site they visit.

We wanted something in between: automated like the first group, transparent like the second.

What We Built

Valdos takes any URL and produces a trust audit in three layers:

Layer 1: Technical Signals

The fastest checks happen before the AI even gets involved:

• Domain reputation — RDAP registration data, domain age, TLD quality. A “10-year-old investment firm” registered 3 months ago is lying.
• DNS infrastructure — MX, SPF, DMARC records. Real businesses configure email properly. Shell operations don’t bother.
• Domain value scoring — Short, dictionary-word domains cost thousands. Scammers don’t invest in premium domains for hit-and-run operations.
• GitHub verification — For developer tools, we extract GitHub repo links and check stars, forks, and archived status via the GitHub API.
• Page health — Broken links, empty pages, missing canonical tags. Real businesses fix these. Throwaway sites don’t care.

Layer 2: AI Fraud Detection

This is where it gets interesting. We feed every technical signal plus the extracted page content to DeepSeek and ask structured questions:

• Is this a real product or a shell?
• What’s the monetization model? Is the pricing transparent?
• Are the testimonials credible or manufactured?
• Does the site use false urgency, unrealistic promises, or impersonation?
• Is the content coherent, or does it read like machine-translated filler?

The AI returns structured JSON — not a subjective essay, but specific findings with evidence. “Fake testimonials detected: all five-star, identical tone, published within 48 hours, reviewer photos match stock photo library.”

Layer 3: The Asymmetric Scoring Model

This was the hardest design decision, and it’s what separates Valdos from every other scanner.

Most tools let the AI assign the final score. We don’t. Our scoring is asymmetric:

• Technical signals are the ceiling. They set the maximum possible score.
• AI can only pull the score down, not push it up. AI can subtract up to 20 points for fraud signals, but can only add a maximum of 3 points.
• Why? Because AI is easily fooled by professional design. A well-designed scam site with clean copy and good UX will fool an LLM into giving it a high score. The data layer doesn’t care about aesthetics — it cares about whether the domain has been around long enough to trust.

The base score is 50. Everything from there is evidence-based adjustments, fully visible in the report.

The Technical Challenge: SPA Content Extraction

Half the modern web is Single Page Applications (React, Next.js, Vue). When you fetch their HTML, you get an empty shell with <div id="root"></div> and a bunch of JS bundles. Traditional scrapers see nothing.

We built a four-layer extraction pipeline:

1. __NEXT_DATA__ hydration JSON — Next.js Pages Router embeds all page data in a script tag
2. __NUXT__ / __INITIAL_STATE__ — Vue/Nuxt and other frameworks’ state objects
3. JSON-LD structured data — Schema.org markup that businesses add for SEO
4. JS bundle string extraction — Scan the actual JavaScript for text content, filtering out CSS, variable names, import paths, and hash noise

For the really stubborn cases, we fall back to Cloudflare Browser Rendering (puppeteer on the edge) — but only when the page is confirmed SPA or has fewer than 200 words of visible text. The free tier gives us 10 minutes of browser time per day, so we use it sparingly.

Dissect: The Business Model X-Ray

The trust audit answers “will this site scam me?” But the boss wanted a second question answered: “is this worth my money?”

That’s Dissect — a separate analysis that examines business models, pricing transparency, and what we call the IQ Tax Score. It checks for patterns we’ve seen across hundreds of “super individual” sites:

• Private consultation funnels (no public pricing, Telegram-only contact)
• Manufactured social proof (stock photo testimonials, unverifiable waitlist numbers)
• Code template products repackaging free open-source libraries at premium prices
• High-pressure sales tactics disguised as limited-time offers

The scoring is deterministic, not AI-subjective. AI provides structured factual observations; code computes the score from those facts. This prevents the “same site, different score every run” problem that plagues AI-driven analysis.

What’s Next

Valdos is live and scanning. Current priorities:

• Content engine — Educational blog content targeting “is this website safe” and “domain reputation check” search queries. The blog is live with our first articles.
• AI compliance scanning — A new detection layer that checks whether sites using AI (chatbots, content generation) properly disclose it under EU AI Act and similar frameworks. The detection logic is built; we’re refining the UX.
• API access — Max tier subscribers get programmatic access to run audits at scale.

A Note on Trust

Valdos doesn’t tell you what to think. A low score doesn’t mean “scam” — it means “look closer.” The tool surfaces signals; the judgment call is yours.

That philosophy comes from the name itself. Valdos comes from a character in a story — a guardian who could see through any disguise. Not by being suspicious of everything, but by knowing exactly where to look.

We thought that was a pretty good job description for a trust scanner.

Try Valdos → — or read our blog post on how to check if a website is safe.