🛡️ PhishSentinel

A modular, terminal-based phishing detection and cybersecurity analysis toolkit built with Python.

PhishSentinel is a defensive cybersecurity project that analyzes URLs, websites, emails, domains, and files for common phishing indicators using rule-based detection techniques. The application runs entirely in the terminal and is designed with a modular architecture for maintainability and future expansion.

---

✨ Features

🌐 URL Scanner

• HTTPS verification
• IP address URL detection
• Long URL detection
• URL shortener detection
• Suspicious keyword detection
• Suspicious TLD detection
• Brand impersonation (typosquatting) detection
• Overall phishing risk score

🌍 Website Scanner

• HTML download and parsing
• Login form detection
• Password field detection
• Hidden iframe detection
• JavaScript redirect detection
• External JavaScript detection
• Suspicious HTML element detection

📧 Email Scanner

• Parse .eml files
• Sender and subject analysis
• URL extraction
• SPF header presence check
• DKIM signature presence check
• DMARC(Authentication-Results) header check
• Suspicious attachment detection
• Phishing keyword detection

🌐 Domain Scanner

• WHOIS lookup
• Domain age analysis
• Domain expiration check
• Registrar information
• DNS record lookup
• MX record lookup
• SSL certificate validation

📁 File Scanner

• SHA-256 hash generation
• MD5 hash generation
• File type detection
• Double extension detection
• Macro-enabled Office document detection
• Executable file detection
• Suspicious filename detection

---

🏗️ Project Structure

PhishSentinel/
│
├── scanners/
│   ├── base_scanner.py
│   ├── brand_detector.py
│   ├── domain_scanner.py
│   ├── email_scanner.py
│   ├── file_scanner.py
│   ├── url_scanner.py
│   └── website_scanner.py
│
├── utils/
│   ├── cli.py
│   ├── helpers.py
│   ├── logger.py
│   ├── risk_engine.py
│   └── validators.py
│
├── models/
│
├── samples/
│   ├── emails/
│   ├── files/
│   └── phishing_test.html
│
├── logs/
│
├── main.py
├── config.py
├── requirements.txt
├── README.md
└── .gitignore

---

⚙️ Technologies Used

• Python 3.12+
• Requests
• BeautifulSoup4
• tldextract
• validators
• dnspython
• python-whois
• colorama

Python Standard Libraries

• ssl
• socket
• hashlib
• email
• pathlib
• logging
• argparse
• re
• json

---

🚀 Installation

Clone the repository

git clone https://github.com/YOUR_USERNAME/PhishSentinel.git

Go to the project directory

cd PhishSentinel

Create virtual environment

python -m venv venv

Activate virtual environment

Windows

venv\Scripts\activate

Linux / macOS

source venv/bin/activate

Install dependencies

pip install -r requirements.txt

---

▶️ Run

python main.py

---

🖥️ Terminal Menu

=========================================================
                PHISHSENTINEL
     Defensive Phishing Detection Toolkit
=========================================================

[1] URL Scanner
[2] Website Scanner
[3] Email Scanner
[4] Domain Scanner
[5] File Scanner
[0] Exit

---

📊 Example Scan Result

=========================================================
SCAN RESULT
=========================================================

Status      : SUCCESS
Scanner     : URL Scanner
Target      : https://paypa1-login.xyz

Risk Score  : 60
Risk Level  : High

Findings

[HIGH]
Category : Brand
Message  : Brand impersonation detected.

[HIGH]
Category : TLD
Message  : Suspicious TLD detected (.xyz)

[MEDIUM]
Category : Keyword
Message  : Suspicious keyword detected: login

---

📝 Logging

Every scan is automatically recorded in

logs/phishsentinel.log

Logged information includes:

• Scanner name
• Target
• Risk score
• Risk level
• Findings count
• Timestamp

---

🛡️ Defensive Purpose

PhishSentinel is developed solely for defensive cybersecurity education and phishing analysis.

It is intended to help users identify suspicious characteristics in URLs, websites, emails, domains, and files. The project does not exploit systems, bypass security controls, or perform offensive security operations.

---

👨‍💻 Author

Sumedh Mhatre

---

📄 License

This project is licensed under the MIT License.