Fish Catcher by Nika Topuria

Fish Catcher watches the website you are on and warns you when it looks like phishing
or a scam. It explains the warning signs in plain language, it never blocks a page, and
it never sends your browsing anywhere. It is built for people who are not security experts.

What it does:

• Checks the page you are visiting for common phishing tricks: fake login pages,
  lookalike domains (paypa1.com, micr0soft.com, look-alike characters from other
  alphabets), confusing links, raw IP addresses, and known bad sites.
• Catches brand-new scams too. A small on-device model spots the random, computer-
  generated web addresses that fresh phishing sites use, and it flags a login, code or
  passkey prompt that appears on a site pretending to be a brand it is not
  (adversary-in-the-middle pages).
• Spots specific scam types: a page that asks you to type your crypto wallet recovery
  phrase or private key, fake "your computer is infected, call this number" tech-support
  pages, and the device-code trick.
• Colors the toolbar icon green, yellow, orange or red so you see the risk at a glance,
  and tells you why in a sentence or two, so you learn to spot it yourself.
• Checks QR codes before you trust them: right-click any QR image, or scan one with your
  camera or from a file in the panel.
• Flags links whose visible text does not match where they really go, and warns about
  shortened links that hide their destination.
• Optional download guard: warns when a download is disguised, like a program pretending
  to be a PDF, with a one-click cancel.
• Family mode: bigger text, a clear alert on dangerous sites, and an optional one-tap
  email to a helper you choose. Nothing is sent until you press send.
• Report this site: one button opens a ready-made report, so a risky site can be added
  to the shared threat list after a person reviews it.

Privacy by design

Everything runs on your device. No account, no tracking, no analytics, no server of ours.
A few optional features can look something up online, and each stays off until you turn
it on: daily threat-list updates (download only), a domain-age check (sends only the
domain name), and Google Safe Browsing with your own free key. Leave them off and Fish
Catcher still protects you.

Honest about mistakes

A warning tool is only worth trusting if you can check how often it is wrong. On the top
100,000 legitimate websites, fewer than 0.01% get a high or critical warning, and the
audit is reproducible with one command.
See fishcatcher.dev/transparency.

Free and open source (MIT). No tool can guarantee a site is safe. Always stay alert when entering passwords.