cat ~/posts/gotfish-phishing-detection-tool.md

GotFish: Phishing Analysis Tool

2025-09-11cybersecurity, Docker, Security, social-engineering

Understanding Phishing in the Modern Threat Landscape

Threat Actors craft communications like emails, websites, and messages that appear authentic to trick users into submitting sensitive information such as passwords, credit card numbers, session cookies, and more. Threat actors today combine human psychology with technical deception to bypass both users and basic filters. GotFish eliminates this risk through analyzing URLs and email addresses to spot malicious infrastructure the Analyst might miss.

Pseudo Algorithm (What Happens Under the Hood)

Phishing Detection Engine:

  // Trusted brands we protect
  TRUSTED_BRANDS = [google, paypal, amazon, microsoft, apple, netflix,
                    instagram, facebook, bank, login, ...]

  // Load or generate DNSTwist permutation database (30,000+ known fakes)
  IF database missing OR older than 30 days
      → Generate fresh typosquatting variants for every brand
        (paypaI.com, gma1l.com, paypal-security.com, etc.)

  FUNCTION analyze(url or email)
      1. Extract & clean domain
         full_domain  → login.microsoft.akama1.net
         root_domain  → akama1.net
         subdomain    → login.microsoft

      2. Instant Block Checks (fast fail)
         • If domain is in OFFICIAL_WHITELIST → SAFE
         • If domain exactly matches known DNSTwist fake → CRITICAL
         • If root domain is a known fake → HIGH RISK

      3. Risk Scoring (0–100+)
         +45  Confirmed DNSTwist typosquat
         +40  Raw IP address (192.168.1.55)
         +40  Contains '@' symbol (old bypass trick)
         +35  Homograph attack (Cyrillic а instead of a)
         +25  Suspicious free TLD (.xyz, .tk, .club, etc.)
         +20  Brand name hidden in subdomain
         +20  Non-ASCII / Punycode characters
         +15  Repeated dashes or too many subdomain levels
         +30  Very similar to real brand (g00gle.com ≈ google)
         +15  Moderately similar to brand

      4. Final Verdict
         ≥70 → CRITICAL RISK
         ≥40 → HIGH RISK
         ≥20 → MODERATE RISK
         ≥10 → LOW RISK
          <10 → SAFE

      5. Return detailed report with reasons + character breakdown

Try it yourself at https://gotfish-910489723534.northamerica-northeast2.run.app/

Detection Techniques Summary

Technique	What It Catches	Risk Points
DNSTwist Database	Pre-known phishing domains (30,000+)	+45–98
Homograph Attack	Fake letters (аррle.com, rnicrosoft.com)	+35
Brand Similarity	g00gle.com, paypaI.com, netfflix.com	+15–30
Suspicious TLDs	.tk, .ml, .xyz, .club, .top, .work	+25
IP Address Domains	http://185.44.66.177	+40
Subdomain Spoofing	paypal.security-update.net	+20
Non-ASCII / IDN	Punycode homographs (xn–pypal-ffa.com)	+20