shohei 2.4.1

Infrastructure diagnostics library: DNS, DNSSEC, TLS certificate inspection, email security, DNS propagation, and MCP-integrated AI agent support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//! URL structure analysis — detect phishing and brand impersonation signals in URL structure.

use serde::{Deserialize, Serialize};
use crate::error::Result;
use url::Url;

/// Request to analyze URL structure.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UrlAnalysisRequest {
    pub url: String,
}

/// Result of URL structure analysis.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct UrlAnalysisResult {
    pub url: String,
    pub scheme: String,
    pub hostname: String,
    pub tld: Option<String>,
    pub subdomain_depth: u32,
    pub path_length: usize,
    pub query_param_count: u32,
    pub is_ip_address: bool,
    pub has_non_ascii: bool,
    pub risk_signals: Vec<String>,
    pub risk_score: u32,
    pub error: Option<String>,
}

const SUSPICIOUS_TLDS: &[&str] = &[".xyz", ".tk", ".ml", ".ga", ".cf", ".pw", ".top", ".click"];

/// Analyze URL structure for phishing signals.
pub async fn check_url_analysis(req: &UrlAnalysisRequest) -> Result<UrlAnalysisResult> {
    let parsed = match Url::parse(&req.url) {
        Ok(u) => u,
        Err(e) => {
            return Ok(UrlAnalysisResult {
                url: req.url.clone(),
                scheme: String::new(),
                hostname: String::new(),
                tld: None,
                subdomain_depth: 0,
                path_length: 0,
                query_param_count: 0,
                is_ip_address: false,
                has_non_ascii: false,
                risk_signals: vec!["invalid_url".to_string()],
                risk_score: 0,
                error: Some(e.to_string()),
            });
        }
    };

    let scheme = parsed.scheme().to_string();
    let hostname = parsed.host_str().unwrap_or("").to_string();
    let path = parsed.path();
    let query = parsed.query().unwrap_or("");

    let mut risk_signals = Vec::new();
    let mut risk_score: u32 = 0;

    // Check 1: IP address as hostname
    let is_ip = hostname.parse::<std::net::IpAddr>().is_ok();
    if is_ip {
        risk_signals.push("ip_hostname".to_string());
        risk_score += 30;
    }

    // Check 2: Non-ASCII characters (homoglyph attack)
    let has_non_ascii = !hostname.is_ascii();
    if has_non_ascii {
        risk_signals.push("non_ascii_hostname".to_string());
        risk_score += 25;
    }

    // Check 3: Subdomain depth
    let subdomain_depth = hostname.matches('.').count() as u32;
    if subdomain_depth >= 4 {
        risk_signals.push("deep_subdomain".to_string());
        risk_score += 20;
    }

    // Check 4: Suspicious TLD
    for tld_str in SUSPICIOUS_TLDS {
        if hostname.ends_with(tld_str) {
            risk_signals.push("suspicious_tld".to_string());
            risk_score += 15;
            break;
        }
    }

    // Check 5: Long path
    if path.len() > 100 {
        risk_signals.push("long_path".to_string());
        risk_score += 10;
    }

    // Check 6: Many query parameters
    let query_param_count = query.split('&').filter(|s| !s.is_empty()).count() as u32;
    if query_param_count > 5 {
        risk_signals.push("many_params".to_string());
        risk_score += 10;
    }

    // Check 7: Excessive hyphens
    let hyphen_count = hostname.matches('-').count();
    if hyphen_count >= 4 {
        risk_signals.push("excessive_hyphens".to_string());
        risk_score += 10;
    }

    // Check 8: Brand names in subdomain (simplified check for common brands)
    let brand_keywords = ["google", "paypal", "amazon", "apple", "microsoft", "bank", "secure"];
    for brand in &brand_keywords {
        if hostname.contains(brand) && !is_ip {
            risk_signals.push("brand_in_subdomain".to_string());
            risk_score += 15;
            break;
        }
    }

    // Extract TLD
    let parts: Vec<&str> = hostname.split('.').collect();
    let tld = if parts.len() >= 2 {
        Some(format!(".{}", parts[parts.len() - 1]))
    } else {
        None
    };

    // Cap score at 100
    let risk_score = std::cmp::min(risk_score, 100);

    Ok(UrlAnalysisResult {
        url: req.url.clone(),
        scheme,
        hostname,
        tld,
        subdomain_depth,
        path_length: path.len(),
        query_param_count,
        is_ip_address: is_ip,
        has_non_ascii,
        risk_signals,
        risk_score,
        error: None,
    })
}