Development of tools for identifying resources
such as Phishing and Shadow-IT
PHISHER is a command-line utility for automated detection of:
- Phishing domains and pages — using signatures, trusted resource lists, SSL certificate analysis, and brand similarity checks.
- Shadow IT — unauthorized cloud services, SaaS applications, unregistered subdomains, and third-party tools used within the company. The tool combines several methods: domain mutation generation, subdomain search by brand names, WHOIS data analysis, and image/keyword verification.
The tool combines several methods: domain mutation generation, subdomain search by brand names, WHOIS data analysis, and image/keyword verification.
- Generation and search of domain mutations — uses dnstwist to create similar domains (typosquatting, homoglyphs, etc.) and verifies their existence through
Netlas. - Subdomain search by brand — searches for subdomains of the
brandname.*type at level 3-4, excluding legitimate top domains. - WHOIS verification — verifies registration data (organization, phone, email) with reference data.
- Double checking of suspicious domains:
- Detection of official images (based on links from the perimeter)
- Search for keywords (brand terms) on the page
Criticality score— each domain gets a rank fromLegitimate(0) toHigh(3).- A beautiful output to the console is a table with a color indication of danger (
richlibrary).
Important
An active API key is required for the service Netlas.io (registration is free, but there are limits on the number of requests)
#!/bin/bash
git clone https://github.com/your-org/fisher.git
cd fisher
pip install -r requirements.txt
python setup.py install- Generation and search of domain mutations — uses dnstwist to create similar domains (typosquatting, homoglyphs, etc.) and verifies their existence through
Netlas. Subdomainsearch by brand — searches for subdomains of thebrandname.*type at level 3-4, excluding legitimate top domains.WHOISverification — verifies registration data (organization, phone, email) with reference data.- Double checking of suspicious domains:
- Detection of official images (based on links from the perimeter)
- Search for keywords (brand terms) on the page
Criticality score— each domain gets a rank fromLegitimate(0) toHigh(3).- A beautiful output to the console is a table with a color indication of danger (
richlibrary).
Important
An active API key is required for the service Netlas.io (registration is free, but there are limits on the number of requests)
Manual installation (PIP is recommended):
#!/bin/bash
pip install netlas dnstwist beautifulsoup4 requests richTip
dnstwist may require the compilation of C extensions. If problems arise, install the dnstwist system package (for example, sudo apt install dnstwist), but the code uses the dnstwist.run() call, which the Python module expects. In this case, adaptation will be required.
The tool accepts a JSON file with a description of the protected perimeter. An example is perimeter_example.json:
{
"domains": ["pochtabank.ru", "pochtabank.phx.media"],
"topdomains": ["pochtabank.ru", "phx.media", "nalogia.ru"],
"brandnames": ["pochtabank", "pochta-bank", "postbank"],
"whois": {
"organisation": ["SC \"Post Bank\""]
},
"keywords": ["Почта Банк", "кредиты", "дебетовые", "карты", "вклады", "ипотека", "банк", "почта"],
"imglinks": [
"https://cdn.pochtabank.ru/_next/image?url=...background_2901_24.jpg"
]
}| Field | Type | Purpose |
|---|---|---|
domains | list of rows | The organization's reference domains. Mutations (typos, substitutions) will be generated for them |
topdomains | list of strings | Valid "top" domains (for example, pochtabank.ru ). They are used to exclude legitimate subdomains during the search |
brandnames | list of strings | Brand names (keywords for searching subdomains like brandname.*) |
whois | object | Expected registration data. The organization key (a list of strings) is supported, as well as phone and email (present in the code, but not in the example) |
keywords | list of strings | Words and phrases specific to the official website (will be searched on suspicious pages) |
imglinks | list of strings | Absolute links to official images (for example, logos, banners). Their presence on the verified resource is checked |
#!/bin/bash
python __main__.py -p <perimeter.json> -a <NETLAS_API_KEY>At startup, an ASCII banner, the version, the name of the team, and the progress of the steps are displayed.
The cout.print_domains() table converts a numeric value to a text level:
| Number | Level | Value |
|---|---|---|
| 0 | Legitimate | Registration data matched the reference → trusted domain |
| 1 | Low | WHOIS didn't match, but there are no official images or keywords on the page |
| 2 | Medium | WHOIS mismatch + one additional feature (image or keyword) |
| 3 | High | WHOIS mismatch + both signs (image + keywords) → high probability of phishing |
Note: The
Criticallevel (4) is not reached in the current implementation, but is reserved in the code.
| Error | Possible cause | Solution |
|---|---|---|
ModuleNotFoundError: No module named "cout" | Launch not from the root directory of the project | Go to the folder where __ is located main__.py, and execute python __main__.py |
read error: File does not exist | Incorrect path to the JSON file is specified | Check the path, use absolute or relative correctly |
dnstwist.run was not found | The dnstwist package is not installed or is installed as a CLI utility | Install via pip install dnstwist or adapt the code to invoke the system command |
Netlas API key invalid | Invalid or expired key | Check the key in your Netlas account, create a new one |
Failed connection with domain | The domain is not responding via HTTP/HTTPS | Check the availability of the domain in the browser. Some resources block bots |
list index out of range in cout.print_domains | wrong_domains contains values greater than 3 or non-numeric | Check the source data: wrong_domains should be dict[domain, int] |
The tool was developed by the Knights of the Round Table team. Version: 1.0.1#dev.
The license is not specified in the source files, but it is intended to be used at the discretion of the authors (probably proprietary). When distributing, keep the title and the mention of authorship.
Caution
🐟 Phisher helps to detect digital threats and unauthorized resources in a timely manner. Use it as part of the perimeter monitoring process.