Phishing Link Detector

Phishing Link Detector

A Python-based desktop application that assesses the likelihood of a link leading to a phishing site, providing a step-by-step explanation for its conclusion.

Features

• Analyzes the link itself: checks for IP addresses instead of domain names, link length, the presence of hyphens or Punycode (xn--), and character substitution (e.g., g00gle or the use of Cyrillic characters in place of Latin ones).
• Examines the target site: verifies HTTPS status, checks the SSL certificate issuer and issuance date, determines domain age via WHOIS, and detects redirects to other domains.
• Cross-references links against public blacklists (OpenPhish and URLhaus) with local caching.
• Calculates an overall probability score based on weighted criteria (using a "noisy OR" model); weights can be customized via a JSON configuration file.
• Provides a real-time analysis log and remains functional even without an internet connection—checks that require network access are simply skipped without compromising the final result.

Tech Stack: Python, Tkinter, requests, ssl/socket, python-whois, pytest, Sphinx

Project Details: Developed by a 4-person team; features a modular architecture; includes 116 automated tests with mocked network calls; documented using Sphinx; developed using Git with dev and feature branches.