How hussein-design/phish-analyzer works
Phish Analyzer Desktop is a local desktop application for turning suspicious .eml files into explainable phishing verdicts and reports. A user uploads a message through the PySide interface; the local API validates and records it, then analysis parses email evidence, evaluates header/body/URL/attachment signals, optionally enriches indicators with threat-intelligence providers, scores the evidence, and persists results for history, detail views, and DOCX export. The graph preserves these documented capabilities; several backend internals are represented at directory level because their source was not sampled.
Main entry points: analysis_service.py Analysis orchestration · analyses.py FastAPI routes · api_client.py API client · main_window.py Main window
Components 31
Desktop UI
- Main window
frontend/views/main_window.py - Upload page
frontend/views/upload_page.py - Upload controller
frontend/controllers/upload_controller.py - History controller
frontend/controllers/analyses_controller.py - Report controller
frontend/controllers/report_controller.py - Settings controller
frontend/controllers/settings_controller.py - API client
frontend/services/api_client.py - Report page
frontend/views/report_page.py
Local API
- FastAPI routes
backend/routes/analyses.py - Settings routes
backend/routes/settings.py
Analysis pipeline
- Upload validation
backend/services/validation_service.py - Analysis orchestration
backend/services/analysis_service.py - Email parser
backend/services/eml_parser_service.py - Threat signals
backend/services/threat_signals.py - URL analysis
backend/services/url_intelligence_service.py - Attachment analysis
backend/services/attachment_intelligence_service.py - Scoring and verdict
backend/services/scoring_service.py - DOCX reporting
backend/services/report_service.py
Persistence and settings
- Analysis repository
backend/repositories/analysis_repository.py - SQLite database
backend/database/session.py - Settings repository
backend/repositories/settings_repository.py - Settings model
backend/models/app_settings.py
Threat intelligence
- VirusTotal provider
backend/services/enrichment/virustotal_provider.py - AbuseIPDB provider
backend/services/enrichment/abuseipdb_provider.py - Shodan provider
backend/services/enrichment/shodan_provider.py - Sandbox provider
backend/services/enrichment/sandbox_provider.py
Other components
- Desktop user
- VirusTotal
- AbuseIPDB
- Shodan
- Sandbox service
Connections 38
- Desktop user → Upload page: selects email
- Main window → Upload controller: connects UI
- Main window → History controller: connects UI
- Main window → Report controller: connects UI
- Main window → Settings controller: connects UI
- Upload page → Upload controller: emits file
- Upload controller → API client: uploads email
- History controller → API client: requests history
- Report controller → API client: requests detail
- Settings controller → API client: reads and saves
- API client → FastAPI routes: HTTP requests
- FastAPI routes → Upload validation: validates upload
- FastAPI routes → Analysis orchestration: starts analysis
- Analysis orchestration → Email parser: parses message
- Analysis orchestration → Threat signals: evaluates indicators
- Analysis orchestration → URL analysis: analyzes URLs
- Analysis orchestration → Attachment analysis: inspects files
- Analysis orchestration → Scoring and verdict: scores signals
- Analysis orchestration → VirusTotal provider: requests enrichment
- Analysis orchestration → AbuseIPDB provider: requests enrichment
- Analysis orchestration → Shodan provider: requests enrichment
- Analysis orchestration → Sandbox provider: requests enrichment
- VirusTotal provider → VirusTotal: queries reputation
- AbuseIPDB provider → AbuseIPDB: queries reputation
- Shodan provider → Shodan: queries IP intel
- Sandbox provider → Sandbox service: submits sample
- Analysis orchestration → Analysis repository: persists result
- Analysis repository → SQLite database: reads and writes
- FastAPI routes → Analysis repository: queries analyses
- FastAPI routes → DOCX reporting: builds report
- DOCX reporting → Analysis repository: loads analysis
- FastAPI routes → Settings repository: loads and saves
- Settings routes → Settings repository: loads and saves
- Settings repository → SQLite database: reads and writes
- Settings repository → Settings model: persists settings
- FastAPI routes → Settings routes: routes settings
- Report controller → Report page: displays results
- API client → Report controller: returns response