Docs

Install it, see what it checks, set it up your way.

Overview

Fish Catcher is a browser extension that warns you, in plain words, when the site you are on looks like phishing or a scam. It never blocks a page, and the checks run on your device.

Click the toolbar icon for the current site's verdict and why: a side panel on Chrome, Brave, Edge and Opera, a popup on Firefox.

Install

Fish Catcher is on both stores. Install it like any other extension; there is nothing to configure.

Installed? See it in action on the demo page. Developers can also build it from the source on GitHub.

Settings

Open Settings from the side panel (Chrome family) or the options page (Firefox). All of these are off by default.

• Strict mode. A dismissible warning banner on high-risk pages. Still never blocks.
• Threat-list updates. See below.
• Domain-age check (RDAP). Asks a public directory how old a domain is. Sends only the domain name.
• Google Safe Browsing. Sends the address you visit to Google. Needs your own free API key.
• Download guard. Warns when a download is disguised, like a program pretending to be a PDF, with a one-click cancel.
• Family mode. Bigger text, a plainer alert, and an optional one-tap email to a helper that only goes when you press send.
• Report this site. Opens a pre-filled report that a maintainer reviews before it reaches the threat list.
• Trusted sites. Sites you mark as trusted stop being flagged. Remove them here anytime.

What it checks

Small signals add up to one score:

• Misspelled or look-alike brand names, like paypa1.com, or a brand's name on a domain it does not own.
• A raw IP address, high-abuse domain endings, deep subdomain chains, and generated-looking names.
• A password, code, or passkey prompt on a site that does not match the brand it claims to be.
• The device-code scam pattern, wallet recovery-phrase requests, and fake tech-support pages.
• Links whose text does not match where they go, and disguised downloads.
• Known-bad sites from the threat list, and Google Safe Browsing if you turn it on.

Well-known sites are recognised and not flagged by mistake.

Risk levels

Threat-list updates

The Fish Catcher registry rebuilds a compact Bloom-filter file of known phishing sites every day from three keyless public feeds: Phishing.Database, URLhaus by abuse.ch, and OpenPhish. With this on, the extension fetches the file once a day, only when it has changed, and matches against it on your device. Download only, never upload.

Build from source

Plain JavaScript, no framework.

node scripts/build.mjs      # build dist/chrome and dist/firefox
node tests/verify.mjs       # run the checks
node scripts/package.mjs    # zip both builds for the stores

FAQ