What is Phisherman?
Phisherman is a lightweight, high-performance phishing detection API built with Node.js, Express, and TypeScript. It analyzes any URL and returns a structured verdict —safe, suspicious, or phishing — by running it through a pipeline of six independent threat checkers in parallel.
Quick Start
Get the API running locally in under five minutes
API Reference
Explore the single endpoint and response schema
How It Works
Learn about the checker pipeline and scoring system
Deployment
Deploy with Docker or run directly with Node.js
Key capabilities
Multi-source threat intelligence
Checks URLs against URLHaus, OpenPhish, PhishTank, PhishStats, and Google Safe Browsing simultaneously
Heuristic analysis
Detects suspicious keywords, domain age, WHOIS data, hyphenated domains, and missing HTTPS
SSRF protection
Blocks private IP ranges, loopback addresses, link-local IPs, and DNS rebinding attacks
Redis caching
In-memory O(1) feed lookups with automatic background refresh every 5–90 minutes per source
How the verdict works
Every URL submitted toPOST /api/check is scored on a 0–100 scale. Each checker contributes points to the total:
| Score range | Verdict |
|---|---|
| 0 – 39 | safe |
| 40 – 69 | suspicious |
| 70 – 100 | phishing |
Architecture overview
Technology stack
| Component | Technology |
|---|---|
| Runtime | Node.js 20, TypeScript |
| HTTP framework | Express 5 |
| Cache / feeds | Upstash Redis (@upstash/redis) |
| Rate limiting | Custom Redis-backed middleware |
| WHOIS lookups | whois-json |
| DNS resolution | Node.js built-in dns/promises |
| Containerization | Docker (node:20-alpine) |