A self-hosted tool that captures suspicious pages from your own vantage point, queries 10 threat intel sources in parallel, and delivers an AI verdict — without leaving traces in public scan logs.
Why this exists
Advanced phishing kits detect datacenter IPs. URLScan and VirusTotal often see a redirect or an empty page. Your capture, from the right network, sees the real thing.
Submitting to URLScan or VirusTotal can tip off attackers if the URL contains victim credentials, internal hostnames, or indicators tied to a live investigation.
Analysts across timezones need a consistent vantage point and a case history everyone can search — not ad-hoc checks from each person's local machine.
Capabilities
Full-page capture with iPhone 14 emulation at 3× scale via headless Chromium.
Vision analysis returns phishing / suspicious / legitimate / inconclusive with a confidence score and risk breakdown.
URLScan, VirusTotal, Shodan, Censys, Google Safe Browsing, OTX, AbuseIPDB, crt.sh, URLhaus, PhishTank — all in parallel.
RDAP lookup pre-fills registrar and hosting abuse contacts. One-click Google Safe Browsing report for confirmed phishing.
Intel populates in ~10 seconds while the screenshot is still loading. No waiting for the full pipeline.
Searchable archive shared across your team. Filter by URL, domain, brand, or verdict.
Anthropic, AWS Bedrock, OpenAI, or OpenRouter. Switch providers with a single env var.
Auto-generated investigation pivots: IP clusters, lookalike domains, CT log history, nameserver and temporal pivots.
In action
Runs on a single Ubuntu VPS. No external database, no cloud dependencies beyond the AI API.