Skip to main content

Utility to manage sets of phishing links making it easier to track their removal progress over time.

Project description

Phishing Tracker

PyPi Python Versions Build Status License

Utility to manage sets of phishing links making it easier to track their removal progress over time.

Project started out of frustration in dealing over-and-over again with phishing threat-actors and wanting an easy tool to handle the tracking of these links over time without needing to roll out a full-fledged CERT stack (eg The Hive)

Captures everything per-run in a single JSON file making it easy to compare and track change over time - and integrate with other tooling if desired.

See examples to get a clear idea on usage and possibilities.

Features

  • Batch mode with .yml configuration file
  • Single shot mode by passing link/hostname/domain in at cli
  • Collects useful reference-information and artifacts per phish link stored in an easy reference json file
  • Create rules to define expected (or desired) analyzers output responses
  • Easy to re-run and hence re-compare the latest status of phish-links over time
  • Debug mode output to STDERR

Analyzers

  • dig-domain - determine domain relative to TLD and collect A, CNAME, NS, MX, TXT records
  • dig-hostname - collect hostname A, AAAA, CNAME, NS, MX, TXT records
  • http-get - perform http (clear-text) GET request capturing request/response headers and response content
  • https-get - as per http-get using HTTPS
  • https-certificate - obtain the https SSL certificate and parse certificate attributes
  • smtp-headers - connect to hostname/domain MX records and capture the server header
  • whois - perform a whois and parse associated attributes

Analyzers - Todo

Install

via PyPi

pip3 install phishing-tracker

via Source

git clone https://github.com/ndejong/phishing-tracker
cd phishing-tracker
python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt
python3 setup.py clean
python3 setup.py test
python3 setup.py install

Project

Analyzer Response Reports

dns_domainname_a_record
dns_domainname_cname_record
dns_domainname_mx_record
dns_domainname_ns_record
dns_domainname_txt_record
dns_domainname_unknown_tld
dns_hostname_aaaa_record
dns_hostname_a_record
dns_hostname_cname_record
dns_hostname_eq_dns_domainname
dns_hostname_mx_record
dns_hostname_ns_record
dns_hostname_txt_record
http_exception
http_hostname_<statuscode>_response
https_certificate_exception
https_certificate_hostname_mismatch
https_exception
https_hostname_<statuscode>_response
safe_browsing_exception
safe_browsing_record
smtp_domainname_active
smtp_exception
smtp_hostname_active
whois_domainname_record
whois_exception

Google Safe Browsing API key

In order to make use of the Google Safe Browsing API lookup, the environment variable GCP_API_KEY needs to be set with an appropriate GCP key that has access to the safe-browsing API - read more here.

Examples

Authors

Nicholas de Jong

License

BSD-2-Clause - see LICENSE file for full details.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for phishing-tracker, version 0.0.6
Filename, size File type Python version Upload date Hashes
Filename, size phishing_tracker-0.0.6-py3-none-any.whl (18.9 kB) File type Wheel Python version py3 Upload date Hashes View hashes
Filename, size phishing-tracker-0.0.6.tar.gz (13.8 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page