cat ~/posts/gotfish-phishing-detection-tool.md

GotFish: Phishing Analysis Tool

2025-09-11cybersecurity, Docker, Security, social-engineering

Understanding Phishing in the Modern Threat Landscape

Threat Actors craft communications like emails, websites, and messages that appear authentic to trick users into submitting sensitive information such as passwords, credit card numbers, session cookies, and more. Threat actors today combine human psychology with technical deception to bypass both users and basic filters. GotFish eliminates this risk through analyzing URLs and email addresses to spot malicious infrastructure the Analyst might miss.

Pseudo Algorithm (What Happens Under the Hood)

Phishing Detection Engine: // Trusted brands we protectTRUSTED_BRANDS = [google, paypal, amazon, microsoft, apple, netflix, instagram, facebook, bank, login, …]// Load or generate DNSTwist permutation database (30,000+ known fakes)IF database missing OR older than 30 days → Generate fresh typosquatting variants for every brand (paypaI.com, gma1l.com, paypal-security.com, etc.)FUNCTION analyze(url or email) 1. Extract & clean domain full_domain → login.microsoft.akama1.net root_domain → akama1.net subdomain → login.microsoft 2. Instant Block Checks (fast fail) • If domain is in OFFICIAL_WHITELIST → SAFE • If domain exactly matches known DNSTwist fake → CRITICAL • If root domain is a known fake → HIGH RISK 3. Risk Scoring (0–100+) +45 Confirmed DNSTwist typosquat +40 Raw IP address (192.168.1.55) +40 Contains ‘@’ symbol (old bypass trick) +35 Homograph attack (Cyrillic а instead of a) +25 Suspicious free TLD (.xyz, .tk, .club, etc.) +20 Brand name hidden in subdomain +20 Non-ASCII / Punycode characters +15 Repeated dashes or too many subdomain levels +30 Very similar to real brand (g00gle.com ≈ google) +15 Moderately similar to brand 4. Final Verdict ≥70 → CRITICAL RISK ≥40 → HIGH RISK ≥20 → MODERATE RISK ≥10 → LOW RISK <10 → SAFE 5. Return detailed report with reasons + character breakdown

**Try it yourself at https://gotfish-910489723534.northamerica-northeast2.run.app/ **