Threat Analysis Scripts

A collection of Python scripts and utilities for cybersecurity threat analysis, phishing detection, and URL reputation scanning.

Included Tools

1. URL Reputation Scanner (url_reputation_scanner.py)

A lightweight command-line utility to quickly check a URL's reputation and underlying domain infrastructure.

• Features:
  • Extracts and analyzes the domain from any given URL.
  • Fetches Domain Age and creation dates via WHOIS records.
  • Resolves standard DNS records (A, MX, NS).
  • Checks for SPF (Sender Policy Framework) TXT records.
  • Checks for DMARC (Domain-based Message Authentication, Reporting, and Conformance) policies.
• Usage:

  python url_reputation_scanner.py <URL>

2. URL Threat Analyzer (url_threat_analyzer.py)

An advanced analysis tool for scanning URLs against threat intelligence feeds to identify malicious activity and detailed threat metadata.

3. PDF Phishing Analyzer (pdf_phishing_analyzer.py)

A utility designed to inspect PDF files for hidden malicious payloads, embedded links, and structural signs of phishing campaigns.

Prerequisites

Ensure you have Python 3.7+ installed. Some scripts require additional third-party dependencies.

To install all the required dependencies for the tools in this project:

pip install python-whois dnspython requests PyMuPDF

Environment Setup

A virtual environment is strongly recommended when running these scripts to avoid package conflicts.

1. Create a virtual environment:

   python -m venv .venv

2. Activate the virtual environment:
   • Windows (PowerShell): .\.venv\Scripts\Activate.ps1
   • Windows (CMD): .\.venv\Scripts\activate.bat
   • Linux/macOS: source .venv/bin/activate

Configuration

This repository contains a config.env file. Depending on the tools you use (such as the url_threat_analyzer.py), you may need to populate this file with specific API keys (e.g., VirusTotal) or other environment configurations required for deep scanning.