Inspiration
The inspiration Came from us wanting to make something that we can use later, while also implimenting out cybersecurity skills in hardening one of the most used attacks to date due to the social engineering aspect of it.
What it does
Because DMARC, SPF, and DKIM all have deterministic values, it becomes an issue of actually flagging which emails are actually suspicious and what aren't. This is because even though you can hard code common phrases, you cannot hardcode all of the most common phrases possible, and that is where the AI checker of the values come in.
How we built it
We split the decision into two layers, the deterministic check based on the DMARC, SPF, and DKIM results, and extract the domain to compare texts to flag suspicious activity such as typo detection and matching domains. On the AI side, we are using a Claude Haiku 4.5 to evaluate the other things that the rules cannot catch, urgency framing, authority impersonation, fear/threat language, and trust exploitation. These signals feed into a scoring engine we designed that weights both findings into a single risk score, along with an explanation of why this is the score to the user. The backend is a FastAPI service with detection logic seperated into its own layer, containerized in docker for development. The frontend is a React + Vite for analyzing a message, browsing verdict history, and inspecting why a score came out the way it did, and a Chrome extension that reads the open message via the Gmail API and scores it inline so the everyday user never leaves their inbox. Postgres stores every email and verdict with per-factor contributions, and a Mailhog sandbox receives synthetic attacks from a red-team service we wrote to grade ourselves.
Challenges we ran into
Because we ran multiple tests, we were hitting usage limits relatively fast, so we had to reevaluate how and when we call the API-Key for requests.
Parsing the actual email was a big problem, some of the parsing of the headers would not work correctly, skewing the score overall.
Accomplishments that we're proud of
The score show how its calculated and why it is calculated that way. Per email, there is a pop-up that shows the value along with a very digestible excerpt on why the specific email got the score that it did
The two layer approach compliments each other very well, by not delegating it all to AI, we create a middle ground where it becomes hard to have false positives that are more likely to happen by not having deterministic values.
What we learned
We learned that Urgency language, while the most obvious, is actually the easiest to get wrong when automating it. You get lots of urgent emails, where they can be very legit in the way that they are sent, so we had to be careful in the way we implement that piece.
What's next for AI-Phishing tool
Harden the extension for emails beyond just Gmail, but other email boxes as well
