GitHub RadarBlue team tool
Open-source phishing detection engine with explainable verdict. Self-hostable alternative to VirusTotal, CheckPhish, URLScan.io Primary language: Go. 103 stars.
Project links:Open GitHub projectBack to radar
<div align="center">
sketchy link? just url.vet it
Open-source phishing detection engine for URLs and domains — paste any link and get a trust score, a fully explainable verdict, and a shareable security report with live page preview, all in real time. No black-box ML result. Every signal explained.
18 concurrent analyzers · 33 signals · DNS · TLS · domain info · typosquatting · redirect chains · content analysis · PhishTank · REST API · Chrome extension · Docker · self-hostable
Open-source self-hostable alternative to VirusTotal, CheckPhish, and URLScan.io
    
⚡ Quick Start · ⚙️ Detection Engine · 🏛 Architecture · 📚 Docs · 🤝 Contributing
<sub>Also known as URLvet · Previously known as SafeSurf</sub>
</div>
---
Paste a URL → get a trust score, verdict, and detailed report in real time.
Image: Phishing Detection Demo
Live demo: https://url.vet _(urlvet)_
git clone https://github.com/abhizaik/urlvet.git
cd urlvet
make startOpen Web UI: [localhost:3000](http://localhost:3000)
Detailed setup guide: docs/setup.md
| Feature | url.vet | VirusTotal | Google Safe Browsing | URLScan.io | CheckPhish | |---------|----------|------------|----------------------|------------|------------| | Live crawl, instant results | ✅ | Partial | ❌ | Partial | Partial | | Explains every verdict | ✅ | Partial | ❌ | Partial | Partial | | Beginner-friendly interface | ✅ | Partial | Partial | Partial | Partial | | Credential form detection | ✅ | ❌ | ❌ | Partial | ✅ | | Follows redirect chains | ✅ | ✅ | ❌ | ✅ | ✅ | | Detailed technical insights | ✅ | ❌ | ❌ | ✅ | Partial | | Live page preview | ✅ | ❌ | ❌ | ✅ | ✅ | | Detection using AI/ML | ❌ | ✅ | ✅ | Partial | ✅ | | Known phishing database coverage | Partial | ✅ | ✅ | Partial | Partial | | Scan multiple URLs at once | ❌ | ✅ | ✅ | ✅ | ❌ | | Browser protection | ✅ | ✅ | ✅ | ✅ | ❌ | | Open source | ✅ | ❌ | ❌ | ❌ | ❌ |
Fast scanners (like Google Safe Browsing) give you a verdict from database lookup with no explanation or live scanning. Deep crawlers (like URLScan.io) take too long. url.vet bridges the gap by doing live analysis with per-signal explanations in real time — and it's open-source.
Analyze a URL via HTTP:
curl "http://localhost:8080/api/v1/analyze?url=https://example.com"Sample Response: <pre><code class="language-json"> { "url": "https://example.com", "trust_score": 100, "verdict": "Safe", "reasons": { "good_reasons": [...] } } </code></pre> Full response schema → docs/api.md#example
18 concurrent goroutines run across 7 signal categories, producing 33 individual signals. Every check emits a reason string — good, bad, or neutral — so the final score is always fully explainable. No black-box verdicts.
Score formula: finalScore = clamp(50 + (trustScore − riskScore) × 0.5) → Risky < 30 · Suspicious 30–64 · Safe ≥ 65
50 is the neutral baseline — a URL with no signals scores exactly 50 (Suspicious), the right default for an unknown URL. Trust signals pull the score up, risk signals pull it down, each weighted at 0.5× so neither dominates alone. Both scores are individually clamped to 0–100 before the formula runs, preventing a single catastrophic signal from drowning all other context.
URL Signals _(8 checks)_
HTTP / Network _(4 checks, single HTTP request)_
DNS _(3 checks)_
TLS / SSL _(2 checks, single TLS handshake)_
Domain Intelligence _(6 checks)_
Content Analysis _(8 checks)_
<iframe> _(credential theft / clickjacking vector)_Threat Intelligence _(2 checks)_
Image: url.vet Analyzer Pipeline
Not a safety guarantee. Use alongside other defenses.
Four containerized services on a shared Docker bridge network. The Go backend is the only service that makes outbound calls to external APIs — the frontend, Chrome, and cache are strictly internal.
| Service | Role | |---|---| | urlvet-web | SvelteKit UI — :3000 (prod) · :5173 (dev) | | urlvet-backend | Go REST API & analyzer engine — :8080 | | urlvet-chrome | Headless Chrome — WebSocket :9222 | | urlvet-valkey | Valkey (Redis-compatible) — :6379, LRU cache, volume-persisted |
sync.WaitGroup; panics are recovered per-task without failing the requestserver/
cmd/urlvet/ entry point
internal/analyzer/ goroutine runner, task definitions, score aggregation
internal/service/
checks/ 18 individual analyzer implementations
screenshot/ headless Chrome integration
cache/ Valkey client
threatfeeds/ PhishTank client
typosquat/ brand similarity engine
web/website/ SvelteKit UI
web/chrome-extension/ browser extension
docker/ dev & prod Compose configs
docs/ API, setup, architecture, security| | | |---|---| | Setup | Local & Docker setup, Makefile commands | | Configuration | All environment variables | | Deployment | VPS, reverse proxy, firewall | | API Reference | Endpoints, rate limits, example response | | Architecture | Services, request lifecycle, detection engine | | Security | Admin auth, password hashing | | Performance | Latency, resource usage, tuning | | Design Decisions | Why things are built the way they are | | Maintenance | Cache, logs, backups | | Glossary | Terms and acronyms |
Interactive API docs (Swagger UI): api.url.vet/swagger/index.html
If you use this project in academic or research work, please cite it — see CITATION.cff.
Copyright (C) 2023–2026 Abhishek K P
url.vet is dual-licensed:
If you found this project helpful, consider giving it a star.
<!-- <div align="center"> <a href="https://star-history.com/#abhizaik/urlvet&Date"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=abhizaik/urlvet&type=Date&theme=dark" /> <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=abhizaik/urlvet&type=Date" /> <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=abhizaik/urlvet&type=Date" /> </picture> </a> </div> -->