Visilant

Visilant is a lightweight, open-source extension (github.com/ikskoder/visilant) that runs entirely on your own device and makes hidden threats visible. Its job is to stop you handing your password to a fake site that looks exactly like the real one. It shows you where a link really goes, points out addresses built to be misread, unfolds short links, and reminds you when you are about to type something into a site you barely know. How it works: Almost every phishing site is a site you have never been to, or have been to once. Visilant counts your visits on your device and protects you on two fronts: * Before you click – it reads the links on the page and tells you the real destination, how well you know it, whether the link text says one thing while the link goes somewhere else, and whether the address itself is built to deceive. * While you are on a site – if you start typing, pasting or copying on a site you hardly know, it says so. This holds inside frames as well, which is where a great many sign-in forms actually live. Because Visilant goes by your own history rather than a list of known-bad sites, it can warn you about a fake the day it appears, without waiting for anyone's blacklist to catch up. KEY FEATURES How well you know a site: three things count, and you decide which of them do. How many times you have been there (10 visits by default), how many separate days you were there (5), and how long you have known the site (10 days). A site has to pass all of them, any one of them, or a number you choose, such as two of three. An afternoon of clicking cannot turn a brand new site into an old friend. Every warning shows its reasoning, in plain words. Instead of a bare "unfamiliar", you see the facts behind it – visits, active days, days known – and, if you want, how far each one is from the mark you set. Every figure also says which name it is about: the address you checked answers for itself, and the figures for the whole domain sit under the domain's own name, each one saying whether it is a total or the strongest single host. A warning only says what is true where it appears: a link to a site you know offers a plain "Go to link" rather than a warning about the road ahead. Sign-in forms inside frames are covered. Many sites put their login form in a frame from another address, and events inside a frame never reach the page around it. Visilant watches inside those frames too, and inside pages built out of custom elements, so typing, pasting and copying raise the same warnings wherever the form was put. An ordinary frame from another address raises no warning of its own: the verdict is about the page you are on, which is the only thing a warning there could ask you to act on. Link safety, before you click: ask about any link (by default with a right-click, or set it to hover or left-click) and a small panel shows where it really goes and how well you know that site. It catches links whose visible text names one site while pointing at another, addresses that put a familiar name in front of an @ so the real site hides behind it (paypal.com@evil.net), addresses that bury a familiar name in the middle so the real one comes last (paypal.com.evil.net, which Visilant spells out as "looks like paypal.com, but the real site is evil.net"), addresses that are only a number, and names that pad out a brand you know (paypal-secure.com). It can also stop the click entirely and ask you to confirm before opening a site you do not know. The right-click check compares what the link says with where it goes, and it works on links within the same site and on email links too. Look-alike detection: an address that is one character away from a site in your own history is called out – a foreign letter that looks exactly like a Latin one, a 1 standing in for an l, a plain typo, or a familiar name buried in a longer address. Because the comparison is against your own history rather than a fixed list of famous brands, what Visilant catches is different for every user and cannot be tested in advance by whoever built the fake. The warning is one short sentence that names the site you know and says how this address is different from it. Strong matches are shown loudly, weak ones stay quiet so you are never trained to ignore them. Each site counted separately: two customers of the same hosting platform are two different sites, so time spent on one of them never makes the other look familiar. Subdomains of a site you know still count towards it. And www.example.com and example.com are one site, so a bank you always open with www. does not look new the day a link leaves the www. off. Shortened links: bit.ly, t.co and about two and a half thousand others hide where they lead. Visilant can unfold them and show the real destination, on demand or automatically, including the whole chain of redirects. A domain you check by hand is marked when it is a short-link service, because your visits to it say nothing about where its links lead. Email addresses: the part after the @ is checked like any other address. Visilant marks addresses at services anyone can sign up to (so you judge the name, not the domain), marks throwaway mailboxes, and knows that Gmail is read at mail.google.com – so an address domain no longer shows a visit count of zero that could never have been anything else. Every recipient of a mailto link is checked, not only the first one. Check anything by hand: a field in the dashboard takes a link, a bare domain, an email address or a QR code image – pasted, dropped in or picked from disk. The field grows to fit what you put in it, so a long address stays readable in full rather than scrolling out of sight. Any selected text on a page can be checked from the right-click menu without leaving the page, and a QR code in a picture can be scanned the same way. Second opinions: under any address you have checked there is a short list of links to services like VirusTotal, urlscan.io and Google Safe Browsing, offered …