GotFish: Forensics and Phishing
Are You Investigating a URL or an Email Address? Run It Through GotFish
GotFish is an educational tool made for phishing awareness; it is designed to help analysts evaluate suspicious URLs, domains, and email addresses. Built with Python 3 and Flask 2.3.3, the application serves as a lightweight, server-side rendered web app.
This tool is analyst-centric. Rather than issuing automated “safe” or “malicious” verdicts, the system instead generates a detailed evidence sheet that breaks down input characters, identifies Unicode confusables, highlights brand similarity and subdomain anomalies, and lastly queries dnstwist.it for registered look-alike domains.
The primary entry point, app.py, acts as a thin HTTP layer enforcing a 100-character input limit for both its web intake form and JSON API (/api/analyze). The application then delegates processing to Phishing_Analyzer.py. Analysis logic handles deep character breakdowns, homograph detection, and IDN/punycode parsing.
The high-level process:
- Parse: Extract scheme, subdomain, root domain, TLD, path, query parameters
- Unicode decomposition: Every glyph gets named. Cyrillic
оbecomes CYRILLIC SMALL LETTER O (U+043E) next to LATIN SMALL LETTER O (U+006F) - IDN/Punycode decoding:
xn--80ak6aa92e.comgets unpacked to its mixed-script Unicode representation - Brand detection: Static list of commonly spoofed entities including PayPal, Google, Microsoft, Apple, Netflix, Amazon, and major banking brands
- dnstwist integration: Query the public API for registered permutations
- Structured output: JSON with findings, character breakdowns, and observations. No verdict. No “safe” label. Just evidence.
The stack is intentionally minimal: single HTML frontend, vanilla CSS, Flask backend, Python 3, requests for API calls.
dnstwist Enumerates Potential Malicious Domains
dnstwist generates permutations algorithmically. Using methods like digit substitution (paypa1.com), character duplication (paypall.com), transposition (paaypal.com), and subdomain abuse (paypal.com.phishing-site.tk), it also predicts and checks domain variations for real-world registration.
However, dnstwist focuses primarily on mechanical typos driven by keyboard proximity or bit-flipping, leaving key visual spoofing vectors unflagged. This creates a critical blind spot for homograph attacks that rely on identical-looking characters from non-Latin alphabets rather than algorithmic typos. For example, in gооgle.com, the two “o”s are actually Cyrillic letters (U+043E), making the domain a visual imitation rather than a standard permutation.
Rendering behavior for these internationalized domain names (IDNs) varies widely across modern software: while some browsers convert homographs into their underlying punycode (xn--ggle-wmc.com) in the address bar, many email clients and mobile messaging apps display the raw glyphs, leaving users entirely vulnerable to the deception.
GotFish vs dnstwist: When to Use Which
If you are building a threat intelligence pipeline, you want both. Here is how they map to different investigative phases:
| Capability | GotFish | dnstwist |
|---|---|---|
| Primary function | Character-level URL/email analysis | Domain permutation generation and enumeration |
| Homograph detection | Native Unicode decomposition | Limited to glyph dictionary permutations |
| Typosquatting | Delegated to dnstwist | Core functionality: bit-squatting, omission, insertion, replacement |
| Live domain checking | Delegated to dnstwist | Native; checks DNS A/AAAA, MX, NS records |
| Output format | Structured JSON with character breakdowns | CSV, JSON, or terminal output with registration data |
| Use case | Investigating a specific suspicious URL | Proactive brand monitoring and domain surveillance |
Design Philosophy: No Verdict
Automation tools are often used unreliably to reach fast verdicts; but automated verdicts frequently fail when edge cases arise. When a tool misclassifies a newly registered phishing domain as a legitimate website based on conservative heuristics, the user lacks the context to understand the decision; they only recognize that the green checkmark lied. By not issuing a definitive “safe” or “malicious” judgment, GotFish forces its users to actively engage with the evidence.
GotFish draws out the underlying signals; it spells out individual characters, identifies Unicode code points, and queries registered domain permutations via dnstwist.
The decision to which the input is malicious or not remains strictly the analyst’s.
Test Cases
paypa1.com
Entry-level typosquatting. Digit substitution. GotFish shows the 1 (U+0031, DIGIT ONE) sitting where l (U+006C, LATIN SMALL LETTER L) should be. dnstwist finds 1,270+ permutations. This works because humans read shapes, not characters.
https://gооgle.com (Cyrillic о)
Punycode decodes to xn--ggle-wmc.com. Two non-ASCII codepoints flagged. Browsers mitigate by showing punycode in mixed-script scenarios, but email clients and messaging apps often do not. Your eyes see “google.” Your browser sees something else entirely.
xn--pple-43d.com
Decodes to mixed-script аррle.com. IDN vulnerability exposed. Some registrars still allow mixed-script registrations in certain TLDs.
"PayPal" <service@paypa1.com>
Display name spoofing. Email clients render the display name prominently. The actual domain hides in gray text. GotFish inverts that hierarchy.
login-paypal.secure-auth.tk
Brand in subdomain, not root. Suspicious TLD. Obvious when you look at the structure. Invisible when you only read the display text.
Bottom Line
If you are investigating a specific URL and need to know what you are actually clicking, character by character and code point by code point.