A coworker almost clicked an invoice email last month from a domain that looked exactly like one of our vendors. One character was swapped. That’s it, one character, and it nearly worked.
That’s what got me building this instead of just talking about it. Been seeing good phishing-detection discussion here lately (the domain-age thread especially), so figured I’d share the actual tool instead of just the idea.
The approach is two signals, combined:
- How new is the domain? Phishing infrastructure is usually registered days or weeks before it’s used, then abandoned.
- How close is the name to something you’d recognize?
paypa1-secure.comis designed to slip past a quick glance atpaypal.com.
Neither signal alone means much. Plenty of legit domains are new. Plenty of similar names are coincidence. But new and a close match together is a genuinely strong signal, way stronger than either check on its own.
What made this worth finishing instead of sitting half-done:
- Parsed, normalized JSON from the WhoisFreaks API, so no fighting inconsistent raw WHOIS text across TLDs
- Historical WHOIS data if you want to check whether a domain recently changed hands (ownership flips are another decent phishing signal)
- No CLI flags or setup gymnastics, just fill in a couple of variables and run it
Rough flow: pull sender domains from mail logs → check registration age + spelling distance against a watchlist → flag anything that hits both → review and quarantine from there.
Also just saw the [Go] cert-checker post here, nice complement to this actually. SSL cert issuance date is one of the signals I’ve been meaning to add next, a domain with no cert or one issued the same day as registration tends to correlate with the same short-lived infrastructure. Might be worth combining the two approaches.
Code’s open sourced here if you want to run it yourself: GitHub - Furqan-Ashraf/Typosquat-detector · GitHub
Wrote up the full story and a technical walkthrough of a bug I hit along the way (missing suffixed typosquats like paypa1-secure.com until I fixed the matching logic) here, if you want the longer version: https://medium.com/@furqanashraf/i-built-a-script-to-catch-phishing-domains-before-they-hit-my-inbox-whois-api-python-38adf6f1d240
Curious how others here are handling this at scale. Anyone layering in DNS/nameserver reuse or ASN data on top of WHOIS? That’s the next thing on my list and I’d rather not reinvent something that already exists.