SentinelScope

Landing page+url scanner
file scanner
Results of url scanning
Results of url scanning
Results of file scanning

Inspiration We kept noticing how often people just click stuff. A weird link in a DM, a "verify your account" email, some random PDF a source sends you. By the time you realize it's sketchy, you've already loaded the page or leaked your location from a photo's metadata. Tools like VirusTotal exist but they're kind of overwhelming and throw a wall of data at you. We wanted something that just tells you "yeah this is fine" or "do not open this" and actually explains why, in normal words.

What it does You paste a link or drop a file and SentinelScope checks it for you before you ever touch it. It follows redirects, looks at the page, and gives you a score out of 100 with a clear verdict from CLEAN to DANGEROUS. The part we're most into is that it explains every point of that score instead of just spitting out a number.

A few things it catches:

where a login form would actually send your password (we flag it when a "PayPal" page is really posting your credentials to some random domain or a Telegram bot) fake lookalike domains like paypa1.com or ones using Cyrillic letters that look identical to normal ones a threat graph that maps out the domain, its IP, who's hosting it, and the SSL cert a replay timeline so you can scrub through what happens step by step when you visit a site metadata in files, including GPS coordinates and author info that people leak without realizing The big thing is it works without any API keys. The external stuff (VirusTotal, urlscan, an AI summary) just adds on top if you have keys, but if they're down or rate-limited the whole thing still works.

How we built it Backend is Python with Flask. Frontend is just plain HTML/CSS/JavaScript, no framework, because we didn't want to deal with a build step. The threat graph uses Cytoscape.js. For file metadata we used Pillow. The scoring isn't an AI black box, it's a weighted rule engine where each finding adds points, so we can always show our work. We added optional hooks into VirusTotal, urlscan.io, and Groq for the parts that need them.

Challenges we ran into A bunch, honestly.

Windows Defender kept silently deleting one of our Python files because the detection code has the same patterns real malware uses (Telegram exfil strings, base64 decoding). It would say the file saved and then it just wasn't there. Took us forever to figure out it was the antivirus. We ended up renaming the file and splitting up the suspicious strings so it stopped getting flagged.

We also burned a lot of time on a "the server isn't updating" bug that turned out to be a stale process still holding port 5000, because the Python process is named python3.12 and we were killing python.exe.

Originally file scanning needed ExifTool installed, which wasn't on the machine, so it just broke. We rewrote it to use Pillow instead so it works out of the box.

And we almost pushed our API keys to GitHub because the .gitignore had quotes around .env that made it not work. Caught it before it went public.

Accomplishments that we're proud of The whole thing runs offline, so a live demo can't really fail on us even if the wifi dies. We're proud that the scoring actually explains itself instead of being "trust me, it's 87." And the two visual features (the threat graph and the replay timeline) came out looking way cleaner than we expected.

What we learned Designing for graceful degradation made everything more solid, every feature still does something useful even when an API is missing. We learned more than we wanted to about antivirus heuristics. And we learned to verify stuff actually works end to end instead of assuming, after the port-5000 thing made us chase a bug that wasn't really a bug.

What's next for SentinelScope We want to add a visual clone detector that screenshots a suspicious page next to the real brand and compares them. More brands in the typosquat list. Saving past scans so you can come back to them. Maybe a browser extension so it checks links right where you click them.