Phishshield

Intercept dangerous links before they load with real-time ML detection and plain-English AI explanations.

Comment

Inspiration

Phishing accounts for over 90% of cyber breaches, but people rarely fall for bad links out of carelessness. Modern phishing sites look almost identical to real ones, and attacks unfold in seconds. Existing blocklists are often too slow to catch brand-new (zero-day) phishing domains. We wanted to build a solution that doesn't just block dangerous links before a page loads, but actually explains why a site is risky in clear, human language so users build better security habits.

What it does

PhishShield AI is an end-to-end security engine that intercepts suspicious links in real time.

  • Desktop Chrome Extension: Runs silently in the background, analyzing links on hover or click. If a threat is detected, it flags the link instantly before navigation happens.
  • Mobile Web App: A clean SOC dashboard where mobile users can copy-paste suspicious SMS, WhatsApp, or email links for quick scanning.
  • Dual Analysis: It pairs lightweight structural URL heuristics with Google Gemini to output safety ratings (Safe, Warning, Critical) alongside plain-English risk explanations.

How we built it

  • Backend: Built with Python and FastAPI, handling feature extraction and real-time inference routing.
  • Machine Learning: Trained an XGBoost model on domain heuristics (length, subdomains, special character entropy, typo-squatting patterns) for rapid risk scoring.
  • AI Analysis: Integrated the Google Gemini API to translate complex security indicators into clear, conversational explanations.
  • Client Interfaces: A Manifest V3 Chrome Extension (built with vanilla JavaScript and CSS) and a responsive dashboard interface.
  • Infrastructure: Deployed serverless API functions to Vercel with custom path routing and runtime environment management.

Challenges we ran into

Deploying an ML-driven Python backend to Vercel's serverless runtime brought serious bundle size and filesystem constraints. We hit memory limits with heavy C-extension dependencies and faced serverless read-only filesystem restrictions with SQLite. Optimizing our dependencies down, switching runtime data writes to temporary storage, and fine-tuning Vercel's entrypoint routing took persistent debugging to get right.

Accomplishments that we're proud of

  • Sub-Second Threat Scoring: Kept heuristic analysis light enough to deliver near-instant evaluation without slowing down natural browsing.
  • Zero-Jargon Feedback: Making security feedback actually readable—replacing cryptic threat codes with clear explanations like "This domain was registered 2 days ago and mimics a bank login."
  • Multi-Platform Access: Delivering background protection on desktop while keeping a seamless web tool ready for mobile users.

What we learned

We gained deep hands-on experience structuring serverless FastAPI microservices, optimizing lightweight ML models for tight bundle limits, navigating Chrome Manifest V3 extension architectures, and designing AI prompts that output practical security advice.

What's next for PhishShield AI

  • Expanding browser support to Firefox and Safari native extension builds.
  • Introducing active page DOM analysis (detecting fake login forms directly on rendering).
  • Building team workspaces and shared threat telemetry for small business security admins.

Built With

Share this project:

Updates