PhishLens

Dashboard Overview
Dashboard Overview - 2

Inspiration

Every day, thousands of fake login pages go up impersonating PayPal, Microsoft, banks, and streaming services — and most of the time, the only thing standing between a victim and a stolen password is whether they notice a slightly-off URL in time. Financial phishing drains over $3.5 billion a year (FBI IC3, 2023), and the defenses that exist are almost always reactive: someone gets phished, someone reports it, and only then does anything happen.

We wanted to flip that. What if the moment a phishing URL appeared anywhere — a live threat feed, an inbox, a link a user is about to click — an AI agent had already scored it, decided how dangerous it was, and acted, all before a human ever had to look at it? That's PhishLens.

What it does

PhishLens is an autonomous AI agent that never sleeps. It continuously pulls real, currently-active phishing URLs from live threat intelligence feeds (OpenPhish, PhishTank), and for every single one, it:

Extracts 31 features — domain age, subdomain depth, brand impersonation signals, character repeats, digit ratios, phishing keyword hints
Scores it with a Random Forest model (Splunk ML Toolkit, trained on 11,430 labeled URLs, 88.29% accuracy)
Classifies the risk — CRITICAL, HIGH, MEDIUM, or SAFE
Writes the full decision to Splunk via HTTP Event Collector

All of this surfaces on a live SOC dashboard — a prioritized "Action Queue" of the scariest URLs right now, a 24-hour threat trend, severity breakdowns, and a pie chart of why each site got flagged.

And then there's the part that protects an actual human: a Chrome extension that scores every page as you navigate to it, and if the AI decides it's dangerous, replaces the page with a warning — before it ever finishes loading.

How we built it

Splunk ML Toolkit as the brain — Random Forest classifier plus HEC-based event ingestion for a fully auditable trail
Python + Flask scoring server doing real-time feature extraction and serving predictions over a REST API
A live agent polling OpenPhish and PhishTank on a schedule, feeding every result through the scorer and into Splunk
Dashboard Studio for the SOC view — KPI tiles, severity charts, attack pattern breakdowns, and the prioritized threat queue
A Chrome extension (Manifest V3) using the webNavigation API to intercept page loads and render a real warning page for dangerous sites, with hover badges on links via a content script

Challenges we ran into

Honesty became a real design constraint. Early on, our dashboard mixed real feed data with synthetic test URLs to make it look "busy" — but that meant the numbers weren't telling the truth about what the system actually caught. We ripped the synthetic generator out entirely so every single number on the dashboard now comes from a real, live phishing URL.

We also went through a hard lesson in credential hygiene — Splunk tokens and passwords had ended up hardcoded in a few scripts during rapid iteration. We rebuilt the config layer around environment variables so nothing sensitive lives in source code anymore.

Accomplishments that we're proud of

A genuinely closed loop: live data comes in, an AI model makes a real-time risk call, a SOC analyst gets a prioritized queue, and a browser extension acts on the same AI decision to protect a user — all running continuously, with zero manual triggering anywhere in the pipeline.

What we learned

The model is maybe 20% of the work. The other 80% is the plumbing — feature extraction that has to be fast enough for real-time scoring, dashboards that have to tell the truth about what's actually happening, and a browser extension that has to fail open (never break someone's browsing) when the AI backend is unreachable.