A developer has released PhishIntel, an open-source Python tool for automated OSINT analysis of websites and assessment of phishing risk. The project was created after the author encountered reports of fraudsters using the classic “Mammoth” scheme with the fake brand Toplivo24 to sell gasoline, gas, and diesel at 20–30% below market price through phishing sites, netting at least 3.7 million rubles in one week.
The application runs with standard Python libraries and produces a structured JSON report after executing a single command. Core modules examine domain composition for suspicious keywords and subdomains, retrieve DNS records (A, AAAA, MX, NS, TXT, CAA, SOA), perform reverse DNS lookups, and collect registration data via both RDAP and WHOIS. Additional checks cover TLS certificate details, HTTP response headers, redirect chains, HTML forms, input fields, external scripts, and the presence of protective headers such as HSTS, CSP, and Referrer-Policy.
Further analysis includes static examination of JavaScript files for risky patterns (eval, fetch, cookie access, obfuscation), retrieval of robots.txt and security.txt, sitemap parsing, and historical comparison of DNS and TLS observations stored in a local JSONL file. Subdomain discovery combines Certificate Transparency logs from crt.sh with brute-force enumeration using a provided wordlist.
When optional tools and API keys are supplied, the report expands to include reputation results from VirusTotal, Google Safe Browsing, and URLhaus, dynamic browser behavior captured via Playwright, and active scans performed by Nmap, Nuclei, or ZAP. A final risk-scoring module aggregates all findings into a numeric score and severity level (informational to critical) with explicit supporting evidence.
The author emphasizes that the code was intentionally kept simple to allow easy customization. The repository is available on GitHub under the name PhishIntel, and the developer welcomes technical feedback from security practitioners on both existing functionality and potential new features.
