Project
InvestShield
A detection service for authorised intermediaries: it watches the public stream of TLS certificates and captures a dated, hash-sealed copy of a site imitating a bank or an investment firm — while that site is still online.
InvestShield is mine. It was built outside my institutional work, on my own infrastructure and from public sources, and it is not the system described in Consob FinTech Paper No. 19 — that one was built inside Consob and belongs to Consob.
Detection normally starts from a complaint. A cloned site promotes, takes clients and disappears within a couple of weeks; the complaint arrives after that, when the site is already offline and the evidence — what it said, to whom, on what date — is gone with it.
A site that wants to look like a bank has to ask for a certificate before it can take anyone’s money, and certificate issuance is public. Detection moves to the start of the story, where the evidence still exists and nobody has lost anything yet.
Those logs were not built for this. They exist so that a certificate issued by mistake or by abuse can be caught by anyone watching: every certificate a certification authority issues is written into a public, append-only register. The same openness that keeps watch on who issues certificates is what makes it possible to notice who asks for them. And because the register is public, the observation does not have to be believed — whoever receives it can repeat it.
Every new certificate, worldwide
The system subscribes to the public Certificate Transparency logs, where every HTTPS certificate appears within seconds of being issued. A site has to pass through there before it can look like a bank.
The ones imitating a supervised firm
Terminology, known brands, name structure and typosquatting patterns narrow the stream to the financial sector. A language model then reads the page in any language and says what is being offered, to whom, and how closely it imitates a firm already on the register.
A copy that outlives the site
What is kept is a dated snapshot with an integrity hash, the pipeline version that produced it and a UTC timestamp on every step, signed and tied to a single identifier — so the signal can still be reconstructed months later, when the site itself is gone.
- It does not qualify. Every signal is a reasoned technical hypothesis; the legal characterisation rests with the competent authority.
- It does not publish. There is no public list of suspect domains, and no signal data is open to the general public.
- It does not block. No action on DNS, registrar or hosting: removal follows the procedures of the competent authorities.
- It does not profile. No personal data of investors, no profiling of the analysed sites’ visitors; the analysis stays on the public content of the pages.
Live, on infrastructure in the European Union: continuous monitoring for authorised intermediaries, and a separate non-commercial channel for supervisory authorities.