Phishing Link Detector

Phishing link detection in documents is the process of scanning Office documents and PDFs for embedded URLs and analyzing them against known phishing indicators. Attackers commonly embed malicious URLs in seemingly legitimate documents - an invoice PDF with a link to a fake login page, a Word document with embedded tracking URLs, or an Excel spreadsheet with links to credential harvesting sites. Our tool examines the internal structure of these documents (Open XML for Office formats, raw text for PDFs) to extract every external URL, then checks each URL against a database of 40+ phishing rules covering domain deception, suspicious TLDs, credential keywords, protocol anomalies, URL obfuscation, shortened URLs, and known phishing patterns. Each URL receives a suspicion score from 0 (safe) to 100 (critical). The tool also detectsauto-execute VBA macros (Auto_Open, Document_Open, Workbook_Open) which are a common phishing vector for delivering malware payloads.

• Suspicious TLDs: Free and untrusted top-level domains commonly used in phishing campaigns - .tk (Tokelau), .ml (Mali), .ga (Gabon), .cf (Central African Republic), .gq (Equatorial Guinea), .click, and .download. These TLDs are popular because they are free or very cheap to register and often have weak abuse reporting mechanisms.
• Domain Deception & Lookalikes: Attackers create domains that visually resemble trusted brands - using zeros instead of letters (g00gle, micr0s0ft), uppercase I instead of lowercase l (paypaI, appIe), transposed letters (rnicrosoft), or adding deceptive prefixes (secure-google, login-paypal, verify-amazon). Our tool checks for 15+ common lookalike patterns and flags suspicious subdomain structures.
• Credential & Security Keywords: URLs containing keywords associated with credential harvesting - login, signin, verify, confirm, account, password, auth, and security. Phishing URLs often use these words in the path or subdomain to trick users into thinking they are on a legitimate authentication page.
• URL Obfuscation: Techniques used to hide the true destination of a URL including @-sign credential smuggling (http://legitimate.com@evil.com), double-slash redirect deceptions (http://example.com//evil.com), heavily encoded URLs with multiple percent-encoded characters, IP address URLs that bypass domain reputation systems, and shortened URL services (bit.ly, tinyurl, ow.ly) that mask the final destination.
• Protocol Anomalies: Unusual URL protocols in documents such as file:// (local file access), data:// (inline data execution), and ftp:// (data exfiltration). These are rare in legitimate documents but common in phishing and malware attacks.

1. Document Parsing: The tool first detects the document type by reading the file header (magic bytes) - ZIP header for Office formats (DOCX, XLSX, PPTX) and %PDF header for PDF files. For Office documents, JSZip decompresses the ZIP structure and we parse the XML content from each internal component: document body (word/document.xml), headers/footers, worksheets (xl/worksheets/sheetN.xml), slides (ppt/slides/slideN.xml), shared strings tables, and hyperlink relationships (.rels files). For PDFs, we extract text content using regex pattern matching on the raw binary.
2. URL Extraction: All extracted text is scanned with URL pattern regexes matching http://, https://, and www. prefixed URLs. We also extract URLs from href attributes in XML content. Duplicate detection ensures each unique URL is analyzed once regardless of how many times it appears in the document. Each URL is tagged with its source location (document body, Slide 3, Sheet 2, Header/Footer, etc.) for context.
3. Phishing Analysis & Scoring: Each extracted URL is parsed into components (protocol, hostname, TLD, domain, subdomain, path, query). The URL and hostname are checked against 40+ phishing rules organized into categories: suspicious TLDs, domain deception, homograph lookalikes, credential keywords, suspicious path patterns, shortened URL services, protocol anomalies, IP address URLs, suspicious ports, and long/complex domain detection. Each matched rule adds to the suspicion score based on its severity (1-10). URLs with scores of 15+ are flagged as suspicious. Additionally, we check for brand name mentions in the domain and count subdomain levels for structural assessment.

Supported file types: DOCX (Word documents), XLSX (Excel spreadsheets), PPTX (PowerPoint presentations), and PDF files. Older binary formats (DOC, XLS, PPT) are not supported as they use a different internal structure (OLE2/CFB) that cannot be easily parsed in the browser. File size limit: Documents up to 100 MB are supported. Larger files may cause browser memory issues. Detection scope: The tool checks URLs against a local rule database of common phishing indicators. It does not perform live reputation checks against external threat intelligence feeds or DNS lookups. While the detection is comprehensive, no tool can catch every phishing attempt. 100% private:All processing is done entirely in your browser using the FileReader and JSZip APIs. Files never leave your device - no uploads, no signup, no data collection, no usage tracking.