All work

Defensive security / Case study

Cyber Dragon

Inspect suspicious messages without opening the link.

A browser workbench that explains the signs of mobile-money scams, lookalike domains, and USSD traps.

Open the live demo
Type
Open-source engineering
Release
v1.0.0
Stack
TypeScript · Python · Next.js 15 · FastAPI
Automated tests
25
Cyber Dragon workbench with fraud inspection modes and built-in sample scenarios
Cyber Dragon · Live inspection workbench

01 / Problem

Why it exists

Phishing and digital fraud in mobile-first markets frequently combine spoofed SMS deposit alerts, USSD call/OTP forwarding traps (*21*, *165*), and combo-squatted lookalike domains. Traditional URL scanners fetch submitted links from backend servers—exposing scanners to Server-Side Request Forgery (SSRF) and alerting attackers via tracking beacons.

02 / Design

How it works

Perform 100% static lexical and structural URI inspection using standard parsers, brand allowlists, edit-distance checks, and Punycode inspection without network I/O.

  1. 5-Dimension Lexical & Structural Threat Analyzer

    Evaluates messages and URLs across credential harvesting, Mobile Money/USSD abuse, domain deception, coercive urgency, and advance-fee fraud in both TypeScript and Python.

  2. Levenshtein & Homoglyph Brand-Impersonation Detector

    Compares hostnames against 18+ protected brands (MTN, Airtel, M-Pesa, Stanbic, Centenary, Equity, Flutterwave, Paystack, Chipper, URA, NSSF, WhatsApp, Telegram, Google, Microsoft, Apple, PayPal, Binance).

  3. PII Scrubber & Incident Report Exporter

    Masks phone numbers, 4–8 digit numeric codes, emails, USSD strings, and secret tokens before generating Markdown or JSON incident briefs.

SSRF-Free Static Heuristic Architecture Over Live URL Fetching
Context
Fetching user-submitted URLs from a backend server exposes internal infrastructure to SSRF and triggers attacker tracking beacons on personalized phishing links.
Decision
Perform 100% static lexical and structural URI inspection using standard parsers, brand allowlists, edit-distance checks, and Punycode inspection without network I/O.
Trade-offs
Cannot inspect destination DOM content behind shortened URLs (bit.ly), which are therefore flagged as obfuscated links requiring independent verification.
Verification
Verified across 12 Node.js unit tests, 8 benchmark scenarios, and 13 FastAPI endpoint tests.
Security and operational constraints
  • Zero external network fetches: untrusted URLs are never visited or resolved.
  • On-device browser analysis mode enabled by default so sensitive text never leaves the user tab unless explicitly submitted.
  • Non-echoing ScanResult contract verified by unit tests so raw credentials never appear in API responses.
  • Zero outbound HTTP/DNS requests are ever performed on user-submitted URLs (eliminating SSRF by construction).
  • ScanResult payloads never echo raw user secrets or URL query tokens.
  • Low indicator scores are always accompanied by an explicit advisory disclaimer rather than a false safety guarantee.

03 / Evidence

How to verify it

Repository-reported / Heuristic Latency & Accuracy

0.28 ms · 8/8 Corpus

100% expected risk-level match across 8 curated fraud & benign control scenarios with zero external network calls

Reproduce from the command line
git clone https://github.com/codesphere-u/cyber-dragon.git
cd cyber-dragon/apps/web && npm install && npm test && npm run benchmark
node --experimental-strip-types bin/cyber-dragon.mjs scan "URGENT: Dial *21*0772112233# now"
View source on GitHubOpen the live demo
Next case study · Developer tools AgentFlight Replay an AI agent’s failure in a test.