Mohammad Waseem

Posted on Feb 3

Detecting Phishing Patterns with TypeScript on a Zero-Budget DevOps Approach

#cybersecurity #typescript #devops

Introduction

In the evolving landscape of cybersecurity, phishing remains a top threat, exploiting human and technical vulnerabilities. For DevOps teams operating with zero budget, creating effective phishing detection mechanisms can seem daunting. However, leveraging open-source tools, scripting, and innovative strategies in TypeScript provides a practical, scalable solution.

The Challenge of Phishing Detection

Phishing URLs often follow certain patterns—suspicious subdomains, peculiar domain extensions, or character manipulations. Identifying these patterns programmatically requires analyzing URLs in real time without access to expensive commercial services.

Approach Overview

Our goal is to build a lightweight, maintainable, and effective detection system entirely in TypeScript. This system will analyze URL features, flag anomalous patterns, and identify suspicious URLs for further review.

Building Blocks

Open-source datasets: Use datasets like PhishTank or custom datasets for known malicious domains.
Pattern matching: Implement regex-based checks for common phishing traits.
Frequency analysis: Track common traits across URLs.
Heuristics: Develop simple rules to score suspicious URLs.

Implementation

1. Setting Up

Create a Node.js project and install TypeScript:

mkdir phishing-detector
cd phishing-detector
npm init -y
npm install typescript @types/node --save-dev
npx tsc --init

2. URL Feature Analysis

Create a script detectPhishing.ts where core detection logic resides:

// List of suspicious domain patterns
const suspiciousPatterns = [
  /\.cn$/,
  /\.xyz$/,
  /\.top$/, 
  /\d{3,}/, // Numbers in domain
  /\-\-/,
];

// Function to analyze URL
function analyzeURL(url: string): { score: number; reasons: string[] } {
  let score = 0;
  const reasons: string[] = [];

  try {
    const urlObj = new URL(url);
    const hostname = urlObj.hostname;

    suspiciousPatterns.forEach((pattern) => {
      if (pattern.test(hostname)) {
        score += 1;
        reasons.push(`Pattern matched: ${pattern}`);
      }
    });

    // Check for uncommon subdomains
    const subdomains = hostname.split('.').slice(0, -2);
    if (subdomains.length > 2) {
      score += 1;
      reasons.push('Unusual number of subdomains');
    }
  } catch (error) {
    // invalid URL
    score += 2;
    reasons.push('Invalid URL format');
  }
  return { score, reasons };
}

// Example usage
const testUrls = [
  'http://login.secure-update.cn',
  'https://normalwebsite.com',
  'http://cheap-shoes.xyz',
  'http://example.top',
  'http://102.134.52.12',
];

testUrls.forEach((url) => {
  const result = analyzeURL(url);
  console.log(`URL: ${url}`);
  console.log(`Suspicion score: ${result.score}`);
  if (result.score > 1) {
    console.log('Potential phishing detected:');
    result.reasons.forEach((reason) => console.log(` - ${reason}`));
  } else {
    console.log('URL appears safe.');
  }
  console.log('---');
});

3. Automating and Integrating

For real-time detection, integrate this script into your network monitoring or email filtering pipeline. Use Node.js services or serverless functions if available.

Enhancing Effectiveness

While this approach is basic, it can be extended by:

Incorporating real-time DNS checks
Cross-referencing domain IPs with blacklists
Analyzing URL content for suspicious keywords
Using machine learning models trained on phishing datasets, all implemented in JavaScript/TypeScript

Conclusion

Detecting phishing patterns without a budget is feasible by focusing on pattern recognition, heuristic rules, and open-source data. TypeScript, coupled with Node.js, offers a flexible and cost-effective platform for dev-focused security tooling. Regular updates and community feedback can significantly improve detection accuracy over time.

By building these lightweight, extensible scripts, DevOps teams can bolster their security posture against phishing threats without relying on costly commercial solutions.

🛠️ QA Tip

To test this safely without using real user data, I use TempoMail USA.

DEV Community