PhishCheck

• 

  Landing Page

• 

  Phishing Result

• 

  Suspicious Result

• 

  Safe Result

Inspiration

HackMatrix is a broad tech event covering blockchain, cybersecurity, and low/no-code — no submission is even required, but we wanted to build something real anyway. Phishing is one of the most common ways people actually get compromised, and most tools just say "this is phishing" without explaining why — which doesn't actually teach anyone to spot the next one themselves. We wanted a tool that shows its work.

What it does

PhishCheck takes any pasted email and gives you a clear verdict — Likely Phishing, Suspicious, or Likely Safe — with a risk score out of 100. More importantly, it doesn't just assert a verdict: every red flag it finds is backed by an exact quote from the email, paired with a plain-English explanation of the specific technique being used (domain spoofing, urgency pressure, mismatched sender, suspicious attachments, credential-harvesting links). If the email is safe, it says so plainly instead of manufacturing flags to look thorough.

How we built it

The backend is Node.js/Express with a single /api/analyze endpoint. It sends the submitted email to a local LLM (Ollama, running Llama 3.2) with a system prompt written specifically for phishing analysis, including a prompt-injection guard so the email's own content can never be interpreted as instructions. The frontend is plain HTML/CSS/JS with no build step — a textarea, three one-click sample emails (Phishing / Suspicious / Legit) for instant demoing, and a color-coded risk-score gauge that's parsed straight out of the model's response.

We deliberately chose a free, fully local model over a paid API — everything runs on-device with no API key and no per-request cost, which also means the tool works completely offline.

Challenges we ran into

Running a small local model (Llama 3.2, 3B parameters) instead of a large hosted model meant output formatting was initially inconsistent — sometimes it would skip sections or format the verdict line differently, which broke the risk-gauge parsing on the frontend. We fixed this by rewriting the prompt with two concrete few-shot examples (a phishing case and a safe case) showing the exact output structure, which made the small model's formatting dramatically more reliable.

Accomplishments that we're proud of

• A genuinely evidence-based analysis, not a black-box verdict — every claim is a direct quote from the email
• Zero-cost, fully local inference — no API key, no per-analysis cost, works offline
• A demo-ready UI: one click loads a realistic sample and the whole pipeline runs in seconds

What we learned

Small local models can produce surprisingly reliable, well-reasoned output for a narrow task if you give them concrete examples of the exact format you want, rather than just describing the format abstractly.

What's next for PhishCheck

• A deterministic typosquat/domain-similarity check running alongside the LLM, to catch spoofed domains with an extra layer of confidence beyond the model's own judgment
• Drag-and-drop .eml file upload instead of copy/paste
• Optional swap to a larger hosted model for higher-stakes use cases

Built With

• css3
• express.js
• html5
• javascript
• node.js
• ollama