Inspiration: Phishing and social engineering attacks have become more sophisticated. Attackers now create convincing URLs, pretend to be trusted organizations, and use urgent or threatening language to trick people into sharing sensitive information.

We set out to build a security solution that goes beyond just checking if a URL is on a blacklist.

Our idea was to create an AI-powered system that can analyze the structure and content of a suspicious URL or message, identify patterns associated with phishing and social engineering, and explain the reasons behind its decision.

What it does: Phishing attacks are becoming harder to recognize. A suspicious URL can look almost identical to a legitimate website, use a trusted brand name, redirect users through multiple pages, or contain hidden malicious payloads.

We built PHISHGUARD AI to address this problem by analyzing suspicious URLs from multiple security perspectives and producing an understandable threat classification.

What if we could detect the warning signs of a phishing website before a user interacts with it?**

Instead of depending on a single URL check, PHISHGUARD AI combines multiple layers of security intelligence, including:

-URL and domain analysis

Phishing and credential-harvesting detection
Brand impersonation and typosquatting detection
Malware and dangerous payload detection
DNS and IP/network intelligence
TLS security analysis
HTTP security and response analysis
Redirect intelligence
Web behavior analysis
Threat correlation and final risk decision

The system correlates the evidence collected from these different layers and produces a final classification such as SAFE, SUSPICIOUS, or MALICIOUS, together with the evidence behind the decision.

How we built it: PHISHGUARD AI was built in Python as a modular security analysis system.

The project was developed incrementally, with each detection capability implemented as an independent intelligence module. These modules are then connected through a central Threat Correlation & Decision Engine.

The decision engine combines the collected security signals instead of relying on only one indicator. This helps the system distinguish between normal security observations and actual threat evidence.

The project also includes automated tests to validate the different detection components and help prevent regressions while developing new capabilities.

Challenges we ran into : One of the biggest challenges was avoiding simple rule-based decisions that could generate false positives.

For example, a URL containing a particular word does not automatically mean that it is malicious. We therefore focused on combining multiple signals and separating diagnostic/security observations from actual threat evidence.

Another challenge was handling different types of threats such as phishing, typosquatting, malicious file extensions, suspicious redirects, and credential-harvesting behavior within the same system.

We also had to debug integration issues between the different intelligence modules and make sure that the final threat decision remained consistent.

Accomplishments that we're proud of: We are proud that we transformed a cybersecurity problem into a working AI-based detection pipeline rather than building only a static phishing checker.

Our key accomplishments include:

Building an AI-assisted phishing detection system
Combining cybersecurity indicators with machine-learning analysis
Incorporating NLP concepts for social-engineering detection
Creating a reusable API-based architecture
Generating explainable security results instead of only binary predictions
Designing the system with real-time integration in mind
Building the project around a practical cybersecurity problem affecting everyday users

Most importantly, PhishGuard AI shows how AI can serve as an additional defense layer between a user and a potential social-engineering attack.

What we learned: During development, we learned that building an AI security system is not simply about achieving a high classification score.

We learned the importance of:

Meaningful feature engineering
Understanding false positives and false negatives
Separating detection from explanation
Designing models around real-world attack behavior
Making machine-learning results understandable to users
Building an API that can be integrated into other security applications
Treating machine-learning predictions as evidence-based risk assessments rather than absolute truth

We also learned that cybersecurity and AI work best together when the model is supported by security-domain knowledge and carefully designed decision logic.

What's next for Real-Time Phishing & Social Engineering Detection API: PhishGuard AI is currently a foundation for a larger security platform.

Our next steps are to expand the system with:

Browser Extension

Integrate the API directly into a browser so suspicious websites can be analyzed automatically while users browse.

Email Security

Allow users and organizations to analyze complete emails, including headers, links, attachments, and message content.

Real-Time Threat Intelligence

Combine machine-learning predictions with domain reputation, DNS information, certificate information, and trusted threat-intelligence feeds.

Advanced AI Models

Experiment with transformer-based NLP models and multimodal models to improve detection of sophisticated social-engineering attacks.

Security Dashboard

Provide organizations with centralized monitoring, attack trends, risk statistics, and incident history.

Explainable AI

Expand the explanation layer so security analysts can see which features contributed most strongly to every prediction.

Our long-term vision is to evolve PhishGuard AI from a detection API into a real-time AI security layer that helps protect users from phishing and social-engineering attacks before they become successful compromises.