Package: andy-fraud
AndyAndy* is an anti-typosquatting suite created tocombat Steam Tradelink & Discord Nitro fraudlinks.
With a correct configuration, Andy will achieve a ridiculous accuracy.
In my tests, Andy achieved a 100% accuracy rate (0% false-negatives) with 0% false positives.While Andy was developed with Steam and Discord in mind, it can hypothetically used for virtually any websites.*any resemblance to persons, whether real or ficticious, is purely coincidental.How it worksGiven a URL, called test URL henceforth, it should be checked whether or not it is a fraudulent URL given the config provided.
In essence, Andy will compute the normalizedLevenshtein distancebetween the test URL and configured valid domains.
If this distance shows high similarity, or it contains part of a valid domain (thinkdiscord-nitrocontainingdiscordfromdiscord.com) it will flag the URL as fraudulent.
Alternatively, it will attempt to perform similar comparisons on the domain contents, URL path and URL querystrings in order to compute a final verdict.ConfigurationAndy requires a valid configuration dictionary.
This will consist of the following keys:KeyTypeDescriptiondomaindict of string keys and string array valuesA dictionary of all legitimate domains (2nd/3rd level) with their associated TLDs.domain_threshold[0-1]How similar the base domain should be to trigger suspicion.domain_keywordsstring arrayA list of fraudulent keywords in the domain.domain_keywords_threshold[0-1]How similar the base domain should be to trigger keyword processing.pathstring arrayA list of fraudulent keywords in the path.path_threshold[0-1]How similar strings in the path should be to trigger suspicion.path_splitbooleanWhether to split on "-" in the path and check parts individually.querystring arrayA list of fraudulent keywords in a querystring.query_threshold[0-1]How similar querystrings should be to trigger suspicion.query_splitbooleanWhether to split on "-" in the querystring and check parts individually.Note:All categories exceptdomain_keywordsuse Levenshtein distance to trigger with "similar" strings.
For example, the keyword "gift" will cause "g1ft" to trigger too.
Additionally, there must be at least one value indomain.Warning:Setting any of the split values totruemay considerably increase your false positive rate if misconfigured.ExampleFor example, using (not all config elements are shown):"domain":{"discord":["com","gg","gift"],"steamcommunity":["com"]}The following URLs will be evaluated as follows:discord.com-> No fraudd1scorrd.com-> Frauddiscord.biz-> Fraudsteamcommunity.com-> No fraudstreamcommmunity.com-> FraudInstallationpip install andy-fraudUsage (library)Andy can be used as a library for other projects.Loading the configFirst, the config needs to be loaded.
The config can be stored anywhere, from purely in-memory to persisting in a JSON file.
For this example, let us assume the config is in a file, and we are parsing it as JSON.config=json.load(config_file)Getting a parsed URLThe algorithm requires a parsed URL.
This can be obtained easily, wherestringis a variable that contains our link as a string.parsed=urllib.parse.urlparse(string)Testing if the URL is fraudulentThis snippet demonstrates how to actually tell if a URL is fraudulent.
It includes the import of the package.fromandyimportsuiteifsuite.is_scam(config,parsed):print("Likely a scam link!")else:print("Probably not a scam link!")Usage (command line)Andy can be run from the command line to test the accuracy of detection.
For this, two files are needed.
Both files contain one domain per line (tailing and leading whitespace is ignored).
The first file, referred to as the legitimate file, will contain only URLs that are not considered fraud.
The second file, referred to as the scam file, will contain only URLs that are fraudulent.
Andy will then test how many of the URLs from the legitimate file Andy flags as fraudulent, and vice versa.Command line argumentsAs such, 3 command line arguments are required:The path of the config file (must be stored in JSON format).The path of the legitimate file.The path of the scam file.Running the scriptMake sure that the package is installed (see above). This is an example, your file names may differ!General:python -m andy config.json legit.txt scam.txtWindows:py -m andy config.json legit.txt scam.txt