Documentation

Install Fish Catcher, understand what it checks, and make it your own.

Overview

Fish Catcher is a browser extension that looks at the site you are on and warns you, in plain language, when it looks like phishing or a scam. It never blocks a page, and it does its checks on your device.

Click the toolbar icon to see the current site's verdict and why. On Chrome, Brave, Edge and Opera it opens a side panel; on Firefox it opens a popup.

Install

Store listings are on the way. Until then you can load it from source in about a minute.

To produce those folders from the source:

git clone https://github.com/Topurrra/fishcatcher.git
cd fishcatcher
node scripts/build.mjs

Settings

Open Settings from the side panel (Chrome family) or the extension's options page (Firefox). Everything is off by default except the on-device checks.

• Strict mode. Shows a dismissible warning banner on high-risk pages. Never blocks the page.
• Threat-list updates. Downloads a daily Bloom-filter file that merges three keyless public feeds (Phishing.Database, URLhaus, OpenPhish). It only downloads, never uploads, and every check is local.
• Domain-age check (RDAP). Asks a public directory service how old a domain is. Sends only the domain name.
• Google Safe Browsing. Off by default. Sends the address you visit to Google, and needs your own free Google API key. How to get a free key.
• Download guard. Warns when a download is disguised, like a program pretending to be a PDF. Offers a one-click cancel.
• Family mode. Bigger text, a clear alert on dangerous sites, and an optional one-tap email to a helper. Nothing sends until you press send.
• Report this site. One button opens a pre-filled report that a maintainer reviews before it reaches the threat list.
• Language. English or Georgian, or follow the browser.
• Trusted sites. Any site you mark as trusted stops being flagged. You can remove it here anytime.

What it checks

Fish Catcher combines many small signals into one score. A few examples, all in plain terms:

• A domain that looks like a misspelling of a known brand, like paypa1.com.
• Look-alike characters used to imitate a brand (homoglyphs).
• A brand's name used on a domain that is not the brand's.
• A raw IP address instead of a normal domain.
• High-abuse domain endings, deep subdomain chains, and generated-looking names.
• A password form on a site that is not a known legitimate domain.
• Adversary-in-the-middle (AiTM) pages: a login, MFA, or passkey flow on an origin that does not match the brand it claims to be.
• The device-code scam pattern, and known-bad sites from the threat list.
• Scam packs: pages asking for a crypto wallet recovery phrase or private key, and fake tech-support pages that tell you to call a number.
• Links whose visible text does not match where they go, and disguised downloads.
• An optional Google Safe Browsing layer, when you turn it on with your own key.

Well-known legitimate sites are recognized so they are not flagged by mistake.

Risk levels

Automatic updates

The list of known phishing sites stays current with no manual work. A companion repository rebuilds it every day, merging three keyless public feeds, Phishing.Database, URLhaus by abuse.ch, and OpenPhish, into one compact Bloom-filter file.

When you turn on Threat-list updates, the extension fetches that file once a day, and only when it has changed. Source: the Fish Catcher registry on GitHub.

Build from source

Plain vanilla JavaScript, no framework, just Node scripts.

node scripts/build.mjs      # build dist/chrome and dist/firefox
node tests/verify.mjs       # run the checks
node scripts/package.mjs    # zip both builds for the stores

FAQ

Does it slow down my browsing?

No. The checks are small string operations that run on your device in a fraction of a second.

Will it block me from a site?

Never. Fish Catcher only warns. You always decide what to do.

Does it send my browsing anywhere?

No. See the privacy policy for exactly what the optional online features send.

It flagged a site I trust. What now?

Open the panel and choose Trust this site. It stops being flagged, and you can undo it in Settings.