July 15, 2026 - 5 min read

By PhishClean Research Team

What's New in PhishClean 1.1.6 - A Harder-to-Fool Detection Engine

Modern phishing pages change while you look at them. This release makes PhishClean re-check the page as it changes, catch domains that only look real, and inspect more of what a page actually loads - so a page has fewer ways to slip past the first two seconds.

Phishing has stopped behaving like a single static page. Attackers inject a login form after the page loads, swap content on a single-page-app route change, register a domain that is one character away from a real brand, or hide their real payload until the browser renders it. PhishClean 1.1.6 is a hardening release focused squarely on those tricks. Here is what changed and why it matters.

Lookalike and homograph domain detection

The new LOOKALIKE_DOMAIN signal flags domains that are visually or structurally impersonating a known brand. It combines three checks: a bounded edit-distance comparison to catch typosquats (micros0ft, paypa1, goggle), brand-token embedding to catch names buried inside unrelated hosts (secure-paypal-login.example.com), and punycode inspection to catch homograph attacks that use non-Latin characters that render like ordinary letters.

These are exactly the domains that survive a quick glance. The address bar looks close enough that a busy person accepts it, especially on a phone where the full URL is truncated.

Live re-scanning as the page changes

A one-time scan at page load misses anything the page does afterward. PhishClean now re-scans on DOM mutations and on SPA navigations - it watches for injected content with a MutationObserver and listens for popstate and hashchange route changes. If a login form appears three seconds after load, or a new "verify your account" panel is swapped into a single-page app, it gets analyzed the same way the original page did.

Deeper secret and credential scanning

Exposed API keys and tokens do not only live in inline scripts. PhishClean 1.1.6 now also scans same-origin external <script> bundles for hardcoded secrets, not just inline tags. That widens coverage for the Secret Leak Scanner and JWT Token Leak Detection, which frequently find keys shipped inside a site's own JavaScript bundles rather than the page HTML.

More reliable domain logic under the hood

Correctly deciding what counts as the "real" registrable domain of a URL is the foundation for almost every phishing signal. This release centralizes that logic into a single shared module used by both the background service worker and the in-page content scripts, backed by a much larger multi-part TLD list. That means fewer edge cases where a multi-part suffix (like co.uk or com.au) was mis-parsed, and consistent decisions everywhere the extension runs.

A clearer, more accessible warning

When PhishClean warns you, that moment has to work for everyone. The warning modal now traps keyboard focus while it is open, restores focus to where you were when it closes, and dismisses on the Escape key. Small changes, but they make the warning usable with a keyboard and screen reader instead of something you have to fight.

Honest gating, verified by tests

PhishClean runs on a 15-day full trial and then a paid plan. In 1.1.6 we removed a dead code path that implied some detectors ran for free after the trial - it never actually protected expired users, and the contradictory comment was misleading. Detection stays strictly gated behind an active trial or paid plan, and that behavior is now covered by an automated browser test that loads the real unpacked extension in Chromium and asserts trial, expired, and paid states behave correctly, alongside live re-scan, whitelist suppression, and popup/options rendering.

Last updated: 13 August 2026