Phishing URL Checker

• 

  Default view — paste a URL to scan it for phishing signals.

• 

  High Risk verdict for a phishing-style URL — with specific reasons listed.

• 

  Suspicious verdict for a URL with two suspicious keywords and no HTTPS.

• 

  Looks OK verdict — minor concern flagged, no major phishing signals.

• 

  Likely Safe verdict for a legitimate site — no suspicious signals detected.

Inspiration

As a cybersecurity student, I've seen how often people fall for phishing links — usually because they look almost legitimate. I wanted to build something simple that anyone could use to quickly check a suspicious URL before clicking it.

What it does

The Phishing URL Checker takes any URL and analyzes it against a set of heuristics used to identify phishing attempts. It returns one of four verdicts — Likely Safe, Looks OK, Suspicious, or High Risk — along with a list of specific reasons for the score.

Detection signals include:

• Suspicious keywords (login, verify, secure, prize, etc.)
• Too many hyphens in the hostname
• Unusually long URLs
• Raw IP addresses instead of domain names
• URL shorteners that hide the destination
• '@' symbols used to disguise the real domain
• Excessive subdomains
• Missing HTTPS
• Trusted TLDs (.gov, .edu, .mil) that subtract from the risk score

How we built it

Built with Python and Flask for the backend logic, and custom HTML/CSS for the frontend with a modern dark UI, animated shield, and a live risk meter. The URL parsing uses Python's built-in urllib library. No database or external APIs — the entire detection engine is pure heuristic analysis.

Challenges we ran into

This was my first hackathon and I worked solo, so I had to balance building the app with learning the tooling. Setting up the Python virtual environment, pushing to GitHub for the first time, and dealing with Windows PowerShell execution policies were all new experiences.

Accomplishments we're proud of

Built a fully working web app from scratch — from Flask setup to a polished frontend with color-coded verdicts and an animated risk meter. It correctly identifies real phishing patterns like http://free-prize-login-secure.com as High Risk, while recognizing legitimate sites like google.com and whitehouse.gov as safe.

What we learned

Learned how to build a Flask app end-to-end, how heuristic URL analysis works in practice, and how to take a project from idea to a polished GitHub repo.

What's next for Phishing URL Checker

• Integration with a real-time threat feed (PhishTank, Google Safe Browsing)
• Machine learning-based classification
• A browser extension for one-click checks
• Screenshot previews of the destination URL

Try it out

Run locally:

python -m venv venv
.\venv\Scripts\Activate.ps1
pip install flask
python app.py

Then open http://127.0.0.1:5000

Built With

• css
• flask
• html
• python
• urllib