WatchPhish

Problem

Security teams and awareness trainers need a unified view of live phishing threats alongside hands-on simulation tools. Manually aggregating data from disparate threat feeds—while also running awareness exercises—is fragmented and slow.

Approach

WatchPhish combines a live threat intelligence dashboard with an attack simulation library in a single full-stack application. It:

1. Ingests phishing URLs from OpenPhish, URLhaus, PhishTank, and ThreatFox in real time.
2. Generates a composite risk score (0–100) for every indicator with a transparent breakdown of the contributing factors.
3. Enriches each indicator with VirusTotal detection scores, urlscan.io analysis, and RDAP domain-age lookups to surface newly registered phishing domains.
4. Geolocates hosts to countries and ASNs and plots them on an interactive world map, with sector-based filtering across Finance, Tech, Government, and Healthcare and a 7-day volume trend.
5. Runs a Brand Monitor that scans Certificate Transparency logs (crt.sh) for typosquatting and lookalike domains—with a watchlist for up to 10 brands and match scoring.
6. Catalogs attack techniques in an Attack Library (descriptions, red flags, real-world examples) and tracks novel Emerging Threats discovered within the last 30 days.
7. Provides eight interactive phishing simulation scenarios (Microsoft Login Phish, PayPal Email, Browser-in-the-Browser, SMS/smishing, QR-code phishing, and more) for security awareness training.

Stack

• Frontend: React 19, Vite 7, TypeScript, Tailwind CSS v4
• UI & Visualization: Radix UI, Framer Motion, Recharts, d3-geo
• Backend: Express 5, Node.js, TypeScript
• Database: PostgreSQL + Drizzle ORM
• Structure: npm-workspaces monorepo splitting frontend, API server, database schema, and API specs into modular packages

What I Learned

• Multi-feed aggregation: Normalising inconsistent schemas across four threat intelligence APIs into a single unified model.
• Risk scoring & enrichment pipeline: Combining VirusTotal detection ratios, urlscan.io analysis, and RDAP registration dates into a transparent composite risk score—with every enricher degrading gracefully when credentials are absent.
• Geospatial threat mapping: Geolocating hosts to countries and ASNs and rendering them on a d3-geo world map alongside real-time distribution and trend charts.
• CT log monitoring: Leveraging certificate transparency feeds to catch brand impersonation before domains go live in threat feeds.
• Simulation UX: Building convincing but safe phishing replicas that teach recognition cues without real risk.