Advanced Phishing Detection & URL Analyzer β Detect phishing URLs, suspicious emails, and credential harvesting attempts using multi-layered heuristic analysis.
- π URL Analysis β Extract 25+ features from any URL including entropy, homoglyphs, punycode, brand impersonation
- π§ Email Header Analysis β SPF/DKIM/DMARC verification, sender mismatch detection, urgency keyword flagging
- π― Brand Impersonation Detection β Identifies spoofed domains targeting 20+ major brands
- π Homoglyph Detection β Catches visual lookalike characters used in domain spoofing
- π Risk Scoring β 0-100 risk score with color-coded terminal output
- π¦ Batch Processing β Analyze hundreds of URLs from a file with CSV/JSON export
- π₯οΈ Beautiful CLI β Rich colored output with ASCII art banner
βββββββ βββββββββββββββ βββββββ βββ βββββββββββββββββ βββ
βββββββββββββββββββββββββββββββββββ βββββββββββββββββ βββ
ββββββββββββββ βββ ββββββββββββββββββββββββββββββββββββββ
ββββββββββββββ βββ ββββββββββ βββββββββββββββββββββββββββ
βββ ββββββββββββββββββββββ βββ βββββββββββββββββ βββ
βββ ββββββββββββββββββ βββ βββ βββββββββββββββββ βββ
Target: http://paypa1-secure.login-verify.tk/account/signin
Risk Level: HIGH RISK
Score: ββββββββββββββββββββββββββββββββ 90/100
β No HTTPS β connection is not encrypted
β Possible impersonation of 'paypal'
β Suspicious TLD commonly used in phishing campaigns
β URL path contains login/authentication keywords
git clone https://github.com/redX000/RedPhish.git
cd RedPhish
pip install -e .Or run directly:
python -m redphishredphish url "http://paypa1-secure.login-verify.tk/signin"
redphish url "https://google.com" -v # verbose mode
redphish url "http://192.168.1.1/login" --json # JSON output# Create a file with URLs (one per line)
redphish batch urls.txt
redphish batch urls.txt -o results.csv
redphish batch urls.txt -o results.jsonredphish email suspicious_email.eml
redphish email phishing.eml --json| Method | Description |
|---|---|
| URL Entropy | Shannon entropy to detect randomly generated domains |
| Homoglyph Detection | Unicode lookalike characters (Π° vs a, 0 vs o) |
| Punycode Analysis | Internationalized domain name abuse |
| Brand Impersonation | Domain matching against 20+ targeted brands |
| TLD Reputation | Flags TLDs commonly abused in phishing (.tk, .ml, etc.) |
| Path Analysis | Login/verification keyword detection in URL paths |
| IP-based URLs | Direct IP address usage instead of domain names |
| SPF/DKIM/DMARC | Email authentication protocol verification |
| Sender Mismatch | From vs Return-Path domain comparison |
| Urgency Keywords | Fear/urgency language in email subjects |
| Score | Level | Description |
|---|---|---|
| 0-19 | β SAFE | No significant phishing indicators |
| 20-39 | π‘ LOW RISK | Minor suspicious elements detected |
| 40-69 | π MEDIUM RISK | Multiple phishing indicators present |
| 70-100 | π΄ HIGH RISK | Strong phishing indicators β likely malicious |
This tool is designed for educational purposes and legitimate security research only. Use responsibly and in compliance with applicable laws. The author is not responsible for any misuse of this tool.
MIT License β see LICENSE
Yassine Lasraoui β @redX000