How does H33-ZK-Phish detect phishing without exposing user data?

ZK-Phish uses zero-knowledge proofs to verify the authenticity of URLs, emails, and pages. SHA3-256 commitments verify every claim without revealing anything about the user or their browsing behavior. The verification is mathematical, not heuristic.

What is a Domain DNA check?

Domain DNA analysis detects lookalike domains using Levenshtein distance calculation, Cyrillic homoglyph mapping (rn to m, 0 to O), suspicious TLD detection, and WHOIS age analysis for freshly registered domains.

How fast is each verification?

All 6 proof streams complete in under 50 microseconds total. Domain DNA takes 12 microseconds, certificate binding 8 microseconds, page structure 15 microseconds, link destination 5 microseconds, and email origin 10 microseconds. Cache hits resolve in 0.08 microseconds.

Does ZK-Phish work with existing email security?

Yes. ZK-Phish complements existing spam filters and email gateways. Spam filters catch 95% of phishing. ZK-Phish catches the remaining 5% that gets through with targeted, well-crafted attacks using valid certificates and lookalike domains.

ANTI-PHISHING

Every Link Checked. Every Email Verified. Every Page Proven.

Name: H33-ZK-Phish
Brand: H33

H33-ZK-Phish uses zero-knowledge proofs to verify the authenticity of every link, email, and page you interact with — before you click. Not after.

Proof streams

<50µs

Per verification

Data exposed

User friction

Start Free Watch Demo Read the Docs

THE PROBLEM

Spam filters catch 95%. The other 5% is the problem.

The phishing emails that get through are the ones engineered to get through. They use valid certificates, real domains with one character changed, and pixel-perfect page clones.

Today

Spam filters catch 95% of phishing emails. The other 5% — the targeted, well-crafted ones — get through. They use valid certificates, real domains with one character changed, and pixel-perfect page clones. Your employees click. Your data is gone.

With ZK-Phish

Every link is verified before it opens. Every email is authenticated beyond DKIM/SPF. Every login page is compared against its real structure. The 5% that gets through spam filters gets caught by math.

VERIFICATION ARCHITECTURE

6 Zero-Knowledge Proof Streams

Every check runs all 6 streams simultaneously. SHA3-256 commitments verify every claim. Zero-knowledge — nothing about the user or their data is revealed.

STREAM 1

Domain DNA

Detects lookalike domains, homoglyphs (rn→m, 0→O), suspicious TLDs, and freshly registered domains. Levenshtein distance + Cyrillic homoglyph map + WHOIS age analysis.

STREAM 2

Certificate Binding

Verifies the TLS certificate was issued to the CLAIMED entity, not just any entity. Checks issuer against 20 known CAs, validates SAN matching, detects self-signed certs.

STREAM 3

Page Structure

Hashes the DOM skeleton of login pages and compares against known-good commitments. Detects cloned pages even when they look pixel-perfect. Catches hidden iframes, external form actions, and suspicious JavaScript.

STREAM 4

Link Destination

Compares displayed URL text against actual href destination. Follows redirect chains up to 5 hops. Detects URL shorteners, javascript: URLs, data: URLs, and @ sign attacks.

STREAM 5

Email Origin

Verifies DKIM signature alignment with From domain. Checks SPF and DMARC results. Analyzes Received header chain for suspicious relays. Validates From/Return-Path alignment.

STREAM 6

QR Payload

Decodes QR codes and verifies the payload matches the claimed destination. Detects evil twin WiFi configurations, malicious vCard URLs, and phishing links embedded in QR codes.

HOW IT WORKS

Three steps. Microseconds.

ZK-Phish intercepts, proves, and delivers a verdict — all before the page loads.

Step 01 — Intercept

Capture Every Interaction

ZK-Phish sits between your users and the content. Every link click, every email open, every page load passes through verification. No browser extension required — works at the DNS, proxy, or API layer.

Step 02 — Prove

6 Simultaneous Proof Streams

6 proof streams run simultaneously in microseconds. SHA3-256 commitments verify every claim. Zero-knowledge — nothing about the user or their data is revealed. The math does the work, not heuristics.

Step 03 — Verdict

Score 0–100

Legitimate (80+), Suspicious (50–80), Phish (below 50). One critical failure — like a homoglyph domain with a 2-day-old WHOIS record — collapses the score to zero. No ambiguity.

COVERAGE

10 Phishing Techniques It Catches

From simple typosquats to sophisticated multi-redirect chains. Every technique that bypasses spam filters — caught by proof.

Homoglyph Domains

chas3.com

Lookalike Subdomains

chase.secure.login.evil.com

Valid Cert on Fake Domain

Let's Encrypt + phish.io

Cloned Login Pages

pixel-perfect DOM clone

Link Text/Href Mismatch

URL Shortener Hiding

bit.ly/3xR... → phish

DKIM Domain Mismatch

From: bank.com via evil.com

Spoofed Return Path

Return-Path ≠ From

Evil Twin QR Codes

WiFi / vCard phish

JavaScript/Data URI Attacks

javascript:void(...)

PERFORMANCE

Microsecond Verification

Every stream completes before the browser finishes the TLS handshake. Cache hits from DashMap resolve in 80 nanoseconds.

12µs

Domain DNA

8µs

Cert Binding

15µs

Page Structure

5µs

Link Dest.

10µs

Email Origin

<50µs

Total / Check

0.08µs

Cache Hit

PRICING

Simple, Usage-Based Pricing

Start free. Scale as your team grows. Every tier includes SHA3-256 zero-knowledge commitments.

Tier	Volume	Price	Includes
Free	1,000 checks/mo	$0	URL + link verification
Pro	50,000 checks/mo	$49/mo	All 6 proof streams + email
Business	500,000 checks/mo	$299/mo	+ page structure + QR + priority
Enterprise	Unlimited	Custom	+ on-prem + custom commitments + SLA

Per-check pricing at scale: $0.001 per verification

Pair With ZK-Proven

H33-ZK-Proven protects the connection. H33-ZK-Phish protects the content. Together, they verify both the pipe AND what flows through it. Man-in-the-middle attacks are stopped at the channel level. Phishing attacks are stopped at the content level. Nothing gets through.

Bundle both products for volume pricing

Learn about ZK-Proven →

INTEGRATION

One API Call. Instant Verdict.

Verify any URL, email, or page with a single request. Results in microseconds.

verify-url.js

const result = await h33.phish.verifyUrl({

  url: 'https://chas3-secure.com/login',

  claimed_entity: 'chase.com'

});

// result.verdict = "PHISH"

// result.score = 0.08

// result.reasons = [

//   "homoglyph_detected",

//   "cert_entity_mismatch",

//   "domain_age_2d"

// ]