{"id":13843080,"url":"https://github.com/utkusen/jeopardize","last_synced_at":"2025-07-23T17:31:08.322Z","repository":{"id":43383039,"uuid":"246581488","full_name":"utkusen/jeopardize","owner":"utkusen","description":"a low(zero) cost threat intelligence\u0026response tool against phishing domains","archived":false,"fork":false,"pushed_at":"2022-12-08T03:47:05.000Z","size":33,"stargazers_count":154,"open_issues_count":3,"forks_count":22,"subscribers_count":9,"default_branch":"master","last_synced_at":"2024-11-21T14:38:23.272Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/utkusen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-11T13:40:01.000Z","updated_at":"2024-10-14T22:08:50.000Z","dependencies_parsed_at":"2023-01-24T10:15:33.172Z","dependency_job_id":null,"html_url":"https://github.com/utkusen/jeopardize","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/utkusen%2Fjeopardize","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/utkusen%2Fjeopardize/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/utkusen%2Fjeopardize/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/utkusen%2Fjeopardize/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/utkusen","download_url":"https://codeload.github.com/utkusen/jeopardize/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227324044,"owners_count":17764604,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:54.680Z","updated_at":"2024-11-30T11:07:06.675Z","avatar_url":"https://github.com/utkusen.png","language":"Python","funding_links":[],"categories":["Python","Python (1887)"],"sub_categories":[],"readme":"## Introduction\n\nJeopardize tool is developed to provide basic threat intelligence\u0026response capabilities against phishing domains at the minimum cost as possible. It detects registered phishing domain candidates (typosquatting, homograph etc.), analyzes them and assigns a risk score to them. After then, it sends valid-looking credentials to the login forms on those phishing sites.\n\n*Why?* Imagine this scenario: Attacker registers a phishing domain, acmebnak.com (Typosquatting of acmebank), copies the original acmebank.com's login form there and advertises this domain via sponsored tweets. This ad and the domain probably will be marked as phishing in the next day but the attacker has already harvested credentials from users. Taking it down after this won't help the affected users. Jeopardize provides a proactive solution to this problem. It jeopardizes the phishing form with valid-looking credentials to confuse the attacker. This will buy organizations some time to take precautions.\n\n\n```\n  ATTACKER+-----advertises+\n                          |                                    +---------------+\n                          |                                    |               |\n                 +--------v-------+   +----------------+       |               |\n                 |twitter.com/ads |   |acmebnak.com    |       | 549233/ahs72 +------\u003eFAKE\n                 +----------------+   +----------------+       |               |\n                 |                |   |                |       | 398273/pass1 +------\u003eFAKE\n                 |  AcmeBank      +--\u003e+  username:     +-------+               |\n                 |  Tax Refunds   |   |  password:     |       | 393823/sm283 +------\u003eLEGIT\n                 |                |   |                |       |               |\n                 +--------^-------+   +----------------+       | 394837/azerb +------\u003eFAKE\n                          |                  ^                 |               |\n  VICTIM USER+-----clicks-+                  |sends            |               |\n                                             |fake creds       +---------------+\n                                             +\n                                         JEOPARDIZE\n```\n\n\n## How it Works?\n\n### 1- Generating the combinations\nJeopardize generates different word combinations with a given domain. ([dnstwist](https://github.com/elceef/dnstwist) helps here) For example, if the given domain is acmebank.com, combinations\nwould be acmebnak, acmeban, amcebank etc. If your domain has a short or generic name (for example: aa.com) This tool\nwon't help you. It works best for unique names.\n\n### 2- Detecting Registered Domains \nJeopardize has two different detection methods to identify registered domains:\n\n**Brute:** Jeopardize combines the generated words (acmebnak, amcebank etc.) with all TLDs (com,net,xyz,live etc.) and does\nwhois query for all of them. *Pros:* Doesn't require any API key, totally free. / *Cons:* Takes lots of time.\n\n**Dailly** With given Zonefiles.io API Key, Jeopardize scrapes all domains registered in the last 24 Hours and searches\nthem for the generated words (acmebnak, amcebank etc.). *Pros:* Fast, can be used as a daily threat intelligence easily.\n*Cons:* Requires Zonefiles.io API Key (Pro edition)\n\n### 3- Analyzing the Domains \n\nDetected domains are already suspicious. But there are factors that increase the likelihood of being a phishing domain. Also, we need to analyze if any phishing page is installed on that domain so that we can take actions against to them. Jeopardize checks the following elements of the registered domains:\n\n- **IP:** If any IP address is assigned to the domain. If yes, the phishing risk score will increase.\n- **Web Server:** If a web server is installed on that domain. If yes, the phishing risk score will increase.\n- **Nameservers:** Checking the nameservers. If it uses Cloudflare, the phishing risk score will increase (no offense)\n- **Website Size:** Checking the size of the website. Phishing pages usually contain different images, css\nand js files. The phishing risk score will increase if it's above a predefined threshold.\n- **Login Form:** If a login form is identified at the website. If yes, the phishing risk score will increase.\n- **SSL Certificate:** Checking the CA of the SSL certificate. If it's issued by a CA other than Cloudflare or LetsEncrypt,\nthe phishing risk score will \"decrease\". \n- **Registration Date:** Checking the registration date of the domain. If it's newer than one month, the phishing risk score will\nincrease.\n- **Alexa Ranking:** Checking the Alexa ranking of the domain. If it's not listed in there, the phishing risk score will increase.\n\n### 4- Jeopardizing Login Forms\nIf the phishing score is high and the website has a login form, Jeopardize will fill it automatically with the provided username/password list.\n\n### Saving the Results\nIt saves the information of detected phishing domains to an XML file. For example:\n\n```\n\u003cdomain\u003e\n  \u003caddress\u003eacmebnak.com\u003c/address\u003e\n  \u003cname_servers\u003ens1.cloudflare.com ns2.cloudflare.com\u003c/name_servers\u003e\n  \u003cmx_servers\u003e \u003c/mx_servers\u003e\n  \u003cdate_flag\u003eTrue\u003c/date_flag\u003e\n  \u003calexa_flag\u003eFalse\u003c/alexa_flag\u003e\n  \u003cwebserver_flag\u003eTrue\u003c/webserver_flag\u003e\n  \u003ccertificate_flag\u003eFalse\u003c/certificate_flag\u003e\n  \u003cform_flag\u003eTrue\u003c/form_flag\u003e\n  \u003cphishing_score\u003e85\u003c/phishing_score\u003e\n\u003c/domain\u003e\n```\n\n## Installation\nJeopardize requires Python3 to work and tested on macOS, Ubuntu 18.04 and Debian based Linux systems. First, clone the repo:\n\n`git clone https://github.com/utkusen/jeopardize.git`\n\nGo inside the folder\n\n`cd jeopardize`\n\nInstall required libraries\n\n`pip3 install -r requirements.txt`\n\nYou also need to install chromedriver for selenium (Required for form filling. I you won't use it, don't need to install)\n\n**on Ubuntu:** Run `sudo apt install chromium-chromedriver`\n\n**on Kali(Debian-based):** Run `pip3 install chromedriver-binary`\n\n**on macOS:** Run `brew cask install chromedriver`\n\nIf you want to integrate Zonefiles.io API, open `jeopardize.py` with a text editor, replace `ZONEFILES_API_KEY = \"\"` with your own key. \n\nYou are good to go!\n\n## Usage\n\n**Note to macOS Users:**  It seems macOS restricts multithreading as a security mechanism. You need to run following command before running\nthe tool: `export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES` for more info about this issue, please check [here](https://stackoverflow.com/questions/50168647/multiprocessing-causes-python-to-crash-and-gives-an-error-may-have-been-in-progr/52230415)\n\nYou need to provide your domain for phishing checking with `--domain` parameter. You also need to provide `--type`(brute,daily,incremental) as registered domain detection method. \n\n**Example command:** `python3 jeopardize.py --domain facebook.com --type brute`\n\n**What it does?:** Combines words combinations of facebook (fcabook, facebkook etc.) with all TLDs(com,net,org,xyz) and does\nwhois query for all of them. Results will be saved to facebook.com.xml file. *This doesn't fill the login forms of the detected domains.*\n\n**Example command:** `python3 jeopardize.py --domain facebook.com --type daily`\n\n**What it does?:** Scrapes all domains registered in the last 24 Hours with Zonefiles.io API and searches\nthem for the generated words (fcabook, facebkook etc.) \n\n**Example command:** `python3 jeopardize.py --domain facebook.com --type incremental`\n\n**What it does?:** It takes a previously generated XML file (facebook.com.xml), scrapes domains in it and updates their data, also does regular daily scan. \n\nIf you want to fill login forms of the detected phishing domains, provide a username list with `-U` and password list with `-P` parameter\n\n**Example command:** `python3 jeopardize.py --domain facebook.com --type daily -U user.txt -P pass.txt`\n\nIf you want to activate verbose mode, add `-v` parameter at the end of the command.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Futkusen%2Fjeopardize","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Futkusen%2Fjeopardize","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Futkusen%2Fjeopardize/lists"}