two-level rule-based detection

Detect phishing domains with lexical and RDAP signals.

Enter a domain or URL. Master Project strips www., computes lexical features, queries RDAP for registration data, and applies a score-based rule set to return a verdict.

How the detection works

Two deterministic filters, combined into a single verdict. No black-box model, every decision is explainable.

Level 1

Lexical filter

Pure string analysis, no network call. Each feature that triggers adds +1 to the score.

F1 domain_length > 20
F2 num_dots ≥ 2
F3 num_hyphens ≥ 1
F4 num_digits ≥ 1
F5 entropy_url > 4.0 (Shannon entropy of full URL)

level1_score ≥ 2 → Phishing, otherwise benign.

Level 2

RDAP filter

Live lookup against the public RDAP service for the registrable domain. Each check that triggers adds +1 to the score.

R1 rdap_missing_flag == 1 (no record)
R2 rdap_domain_age_days < 365 (young)
R3 rdap_domain_age_days < 365 and rdap_days_to_expiry < 180

level2_score ≥ 1 → Phishing, otherwise no RDAP flag.

Verdict

Fusion logic

Phishing Level 1 OR Level 2 flagged
Legitimate Both levels clean

Leading www. is stripped before any analysis.

About

Master Project is the master rule-based phishing detection tool. It combines five lexical features (Level 1) with three RDAP-based checks (Level 2) into a transparent score-based verdict on real-world URLs and domains.

Designed to assist phishing detection, though no detection method is ever 100% accurate.

RDAP queries are performed through RDAP.org. No query data is stored server-side.