Olyx

A modern Android application for comprehensive URL security analysis, combining multiple threat detection APIs with advanced domain spoofing detection to protect users from malicious websites.

Screenshots

Features

Multi-API Security Analysis

• AbuseIPDB: Scans IP reputation for reported malicious activity
• VirusTotal: Checks URLs against 70+ antivirus engines
• URLScan.io: Performs deep website behavioral analysis
• Real-time Results: Progressive loading with immediate partial results

Domain Spoofing Detection

• 200+ Protected Domains: Pre-loaded database of legitimate websites (Google, PayPal, banks, etc.)
• Character Substitution Detection: Identifies homograph attacks (g00gle.com, paypa1.com)
• Levenshtein Distance Analysis: Catches typosquatting attempts
• TLD Variations: Detects suspicious domain extensions
• Smart Filtering: Distinguishes legitimate regional variants (.com vs .fr)

Intelligent Scoring System

• False Positive Detection: Identifies outlier API responses using statistical analysis
• Spoofing Penalty: Automatically reduces scores for suspicious domains (up to -50 points)
• Weighted Aggregation: Combines multiple API results for accurate risk assessment
• Dynamic Confidence Levels: Safe, Likely Safe, Moderate, Risky, Malicious

User Experience

• Material Design 3: Modern, polished dark theme interface
• Adaptive Layout: Optimized for both portrait and landscape orientations
• Search History: Persistent local storage with swipe-to-delete
• Fade Animations: Smooth transitions and visual feedback
• Collapsing Headers: Space-efficient navigation
• URL Sharing: Direct integration with Android share menu

Visual Indicators

• Color-Coded Scores: Red to green gradient based on safety level
• Animated Loading: Purple gradient wave for API calls in progress
• False Positive Warnings: Orange labels for suspicious outlier results
• Spoofing Alerts: Dedicated cards with suspicion level percentage
• Scroll Indicators: Radial gradient hints for additional content

Getting Started

Prerequisites

• Android Studio: Ladybug or newer
• Android SDK: API 29+ (Android 10+)
• Gradle: 8.0+
• JDK: 11+

API Keys Required

Create a secrets.properties file in the root directory:

ABUSEIPDB_API_KEY=your_abuseipdb_key
VIRUSTOTAL_API_KEY=your_virustotal_key
URLSCAN_API_KEY=your_urlscan_key

Important: By using this application, you must comply with the Terms of Service of each API provider:

• AbuseIPDB Terms
• VirusTotal Terms
• URLScan.io Terms

Installation

1. Clone the repository

   root@kitploit:~

   git clone <repository-url>
   cd olyx
   

2. Configure API keys

   root@kitploit:~

   cp secrets.properties.example secrets.properties
   # Edit secrets.properties with your API keys
   

3. Build and run

   root@kitploit:~

   ./gradlew assembleDebug
   ./gradlew installDebug
   

Project Structure

olyx/
├── app/
│   ├── src/main/
│   │   ├── java/com/olyx/
│   │   │   ├── data/
│   │   │   │   ├── Models.kt              # ApiResult, HistoryEntry
│   │   │   │   ├── HistoryManager.kt      # Persistence logic
│   │   │   │   └── SpoofingDetector.kt    # Domain analysis engine
│   │   │   ├── network/
│   │   │   │   └── ApiService.kt          # API integrations
│   │   │   ├── ui/
│   │   │   │   ├── components/
│   │   │   │   │   ├── ApiScoreCard.kt    # Individual API results
│   │   │   │   │   └── GlobalScoreCard.kt # Aggregate score display
│   │   │   │   ├── screens/
│   │   │   │   │   ├── HomeScreen.kt      # URL input
│   │   │   │   │   ├── AnalysisScreen.kt  # Results display
│   │   │   │   │   ├── HistoryScreen.kt   # Search history
│   │   │   │   │   └── AboutScreen.kt     # App information
│   │   │   │   ├── theme/
│   │   │   │   │   ├── Color.kt           # Dark theme palette
│   │   │   │   │   ├── Theme.kt           # Material3 setup
│   │   │   │   │   └── Type.kt            # Typography
│   │   │   │   └── utils/
│   │   │   │       └── ScoreUtils.kt      # Scoring algorithms
│   │   │   ├── utils/
│   │   │   │   └── Constants.kt           # App constants
│   │   │   └── MainActivity.kt            # Entry point
│   │   └── res/
│   │       ├── raw/
│   │       │   └── legitimate_domains.txt # Protected domains list
│   │       └── font/
│   │           ├── gemunulibre_regular.ttf
│   │           └── redhatdisplay_regular.ttf
├── screens/                                # Screenshots
├── build.gradle.kts
└── secrets.properties                      # API keys (not in repo)

Customization

Adding Protected Domains

Edit app/src/main/res/raw/legitimate_domains.txt:

yourbank.com
yourbank.fr
yourbusiness.com

Adjusting Detection Sensitivity

Modify thresholds in SpoofingDetector.kt:

private fun calculateSuspicion(...): Int {
    if (distance == 1) return 90  // Very similar → High risk
    if (distance == 2) return 70  // Somewhat similar → Medium risk
    if (distance == 3) return 50  // Less similar → Low-Medium risk
}

Changing Score Penalties

Update spoofing impact in ScoreUtils.kt:

val penalty = (spoofingResult.suspicionLevel * 0.5).toInt()  // 50% of suspicion level

Built With

• Kotlin - Modern, concise programming language
• Jetpack Compose - Declarative UI framework
• Material Design 3 - Latest design system
• OkHttp - HTTP client for API calls
• Kotlinx Serialization - JSON parsing
• Android SharedPreferences - Local data persistence

Security & Privacy

• No Cloud Storage: All data stays on device
• No User Tracking: No analytics or telemetry
• API Privacy: Only URLs are sent to third-party services
• IP Extraction: Performed locally before API calls
• Minimal Permissions: Only requires INTERNET permission

Testing

# Run unit tests
./gradlew test

# Run instrumented tests
./gradlew connectedAndroidTest

# Generate coverage report
./gradlew jacocoTestReport

Algorithms

False Positive Detection

Uses statistical deviation analysis:

• Calculates mean of all API scores
• Flags results deviating >40 points from mean
• Requires ≥2 results within 20 points of mean for consensus

Spoofing Score Calculation

Base Score = Average(API Scores)
Penalty = Suspicion Level × 0.5
Final Score = max(0, Base Score - Penalty)

Levenshtein Distance

Computes minimum edit operations (insert/delete/substitute) between strings to detect typosquatting.

Authors

• Julian Melha - @Shacode
• Guillaume Honoré - @Guimee

Acknowledgments

• AbuseIPDB, VirusTotal, and URLScan.io for their APIs
• Material Design team for the design system
• Jetpack Compose team for the modern UI framework

📄 License

This project is licensed under the GNU Affero General Public License v3.0. See LICENSE for details.