OCTIO-Labs/visual-threat-intel

Visual phishing detection engine for East African financial and telco brands. Screenshots suspected URLs, encodes with CLIP, and compares against a reference index of legitimate brand interfaces. A visual layer for OCTIO's threat intelligence pipeline. # visual-threat-intel Visual phishing detection engine for East African financial and telco brands. Screenshots suspected URLs, encodes with CLIP, and compares against a reference index of legitimate brand interfaces. A visual layer for OCTIO's threat intelligence pipeline. ## Protected brands Safaricom, M-Pesa, Equity Bank, KCB, Co-operative Bank, Airtel Kenya, Standard Chartered Kenya, DTB, Absa Kenya, Flutterwave. ## How it works ## Setup ```bash pip install -r requirements.txt playwright install chromium # capture reference images from official brand sites python3 -c " from visual_threat_intel.phishing.brands import BRANDS from visual_threat_intel.phishing.screenshotter import capture_reference_images capture_reference_images(BRANDS) " # build the brand reference index python3 -c " from visual_threat_intel.phishing.index import PhishingIndex PhishingIndex().build() " ``` ## Usage ```python from visual_threat_intel.phishing.detector import PhishingDetector detector = PhishingDetector() result = detector.scan("safaricom-ke-login.suspicio…") print(result) # { # "phishing": True, # "matched_brand": "safaricom", # "matched_brand_name": "Safaricom", # "similarity": 0.91, # "official_url": "safaricom.co.ke", # "reason": "domain_mismatch" # } ``` ## Part of OCTIO-Labs This module is the visual intelligence layer of the OCTIO threat detection pipeline. Text-based URL classification lives in OCTIO-Labs/OCTIO.