Enterprise App Protection

A browser extension that flags links whose visible text names a known enterprise app (e.g. "DocuSign", "Microsoft 365", "ServiceNow") but whose destination domain isn't one of that app's known domains.

---

Why this exists (read this first)

Modern browsers already do a lot of phishing protection for you: Chrome and Edge use Google Safe Browsing, Edge adds Microsoft Defender SmartScreen, and Microsoft 365 tenants with Defender get Safe Links rewriting and scanning. If you already have those, do you need this too?

Mostly, those systems are reputation-based — they protect you once a malicious domain has been seen, reported, and added to a blocklist. They are very good at this, but there's an inherent gap: a brand-new lookalike domain registered an hour ago, used in a single targeted email, won't be in any reputation database yet.

This extension targets exactly that gap. It doesn't know anything about reputation — it only checks one thing: does this link's text claim to be "DocuSign", and if so, does the link actually point somewhere DocuSign owns? That check works on day zero, with no internet connection, because it's just comparing text to a local list.

Be realistic about its limits:

• It only fires when the link's visible text names a known app. A link with no brand name in its text (<a href="...">Click here</a>) is invisible to it.
• The "known domains" list (domains.json, ~1000 apps) is maintained by one person and will never be complete. Treat it as a useful extra signal, not a verdict. Domains for the less prominent apps haven't all been individually verified — if you spot an incorrect or missing domain, a PR is welcome.
• It is a complement to Safe Browsing / SmartScreen / Defender, not a replacement.

---

What it does

• Scans links on every page you visit (<all_urls>), including same-origin iframes and content added dynamically (e.g. Outlook Web, Teams, SharePoint).
• When a link's text mentions a known app but its href domain isn't on that app's known-domains list, a small warning badge (⚠) is inserted next to the link. Clicking it opens a popover explaining the mismatch, with a "Trust this domain" button.
• You can also maintain a Blocked Domains list — any link to those domains is flagged regardless of its text.
• A dashboard lists every flagged link (timestamp, claimed app, destination, source page), with search and a one-click "Trust this domain" action.
• The app/domain database ships bundled with the extension so it works offline immediately after install, and refreshes periodically (and on demand) from a configurable URL.
• Light and dark mode, following your system theme.

---

Privacy

• No tracking, no analytics, no accounts.
• All link analysis happens locally, synchronously, in the content script — no per-link network requests of any kind (no Safe Browsing API, no third-party lookups).
• The only network activity is a periodic fetch of domains.json from the URL configured in Settings (defaults to a public repo), so the app/domain list can be updated without reinstalling the extension.
• Flagged-link history (used by the popup and dashboard) is stored only in chrome.storage.local and never leaves your device.

---

Installing

1. Clone or download this repository.
2. In Chrome/Edge, go to chrome://extensions (or edge://extensions).
3. Enable Developer mode.
4. Click Load unpacked and select this folder.

Requires Chrome/Edge 116+.

---

Using it

Warning badges

When a flagged link is found, a small warning icon appears right after it. Click it to see why it was flagged and, if it's a false positive, click Trust this domain — that domain will never be flagged again (on any page).

Popup

The toolbar popup shows how many links have been flagged in total, your five most recent flags, and quick links to the dashboard, settings, and domain management — these open (and reuse) a single tab, with a nav bar at the top to switch between them. The popup also lets you trigger a manual database update or reset the counter.

Dashboard

Open Open dashboard from the popup for a full, searchable history of every flagged link: which app was claimed, what domain it actually pointed to, and which page it was found on. You can trust a domain or clear the whole history from here.

Settings

Configure the domains database URL, how often it refreshes (1–168 hours), and the warning message template (use {app} as a placeholder for the app name).

Domain management

Manually add, edit, or remove domains from your Trusted and Blocked lists.

---

How matching works

1. The extension builds one combined list of enterprise app names from domains.json.
2. For each link on the page, it checks whether the link's visible text contains one of those names as a whole word (case-insensitive).
3. If it does, it compares the link's destination domain (and registrable top-level domain) against that app's list of known domains.
4. If the destination isn't a known domain for that app, the link is flagged as a possible lookalike.
5. Separately, any link to a domain on your Blocked Domains list is flagged regardless of its text.

Links to the current page's own domain, and domains you've marked as Trusted, are never flagged.

---

Contributing to domains.json

domains.json maps app names to arrays of domains that legitimately belong to them. Pull requests adding new apps or correcting domains are welcome — keep entries alphabetical and verify domains actually belong to the named service before adding them.