4-Layer Security Pipeline · Live

PhishGuard

Detect phishing URLs instantly — powered by VirusTotal, pattern heuristics, domain intelligence & a trained Random Forest classifier.

86.72%
ML Accuracy
4
Detection Layers
Live
Threat Analysis
Check a URLView API Docs
scroll
// threat scanner

Analyze Any URL

Advanced threat analysis powered by a multi-layered security pipeline.

// architecture

4 Detection Layers

Every URL passes through all layers simultaneously. Scores are weighted and aggregated into a final verdict.

⌘ Input URL
01
VirusTotal Blacklist
Cross-references 90+ antivirus engines and threat databases in real-time. Any engine flagging the URL immediately elevates the risk score.
blacklist35%
02
Pattern Analysis
Regex heuristics detect brand impersonation, IP-as-hostname, typosquatting, excessive subdomains, and hex-encoded redirects.
pattern20%
03
Domain Intelligence
WHOIS lookup checks registration age. Domains under 30 days, unknown registrars, and missing creation records are strong phishing signals.
domain10%
04
ML Model — Random Forest
Trained on 11,000+ labeled URLs with 30+ engineered features. 86.72% accuracy. Final arbitrator when other signals are inconclusive.
ml35%
Final Weighted Risk Score
// case study

How I Built This

The Problem

Phishing attacks cause over $1.8B in losses annually. Blocklists alone can't keep up — attackers spin up new domains in seconds. I wanted to build a layered detector that doesn't rely solely on known-bad lists.

Architecture

FastAPI backend with async-native design. All 4 detection layers run independently — blacklist, pattern, domain, ML — and their scores are weighted and aggregated. Each layer is isolated and independently testable.

ML Training

Trained a Random Forest on 11,000+ URLs from the UCI Phishing Websites dataset. Engineered 30+ features: URL length, subdomain depth, digit ratio, HTTPS presence, domain age, TLD rarity. Final model: 86.72% accuracy.

Challenges

VirusTotal rate limits required caching and graceful degradation. WHOIS lookups were unreliable across TLDs — added fallbacks. Balancing speed vs. thoroughness was the hardest tradeoff.

What I Learned

Ensemble detection is far more robust than any single signal. Feature engineering matters more than model selection for URL-structured data. Building for failure — timeouts, bad data, unavailable APIs — separates demos from real systems.

Tech Stack
FastAPI
Backend API
scikit-learn
ML Model
Random Forest
Classifier
VirusTotal API
Blacklist Layer
python-whois
Domain Intel
Next.js 14
Frontend
Framer Motion
Animations
Vercel
Deployment
// api reference

Try the API Yourself

One endpoint. Send a URL, get a full threat analysis.

POST/api/check-urlContent-Type: application/json
$request.sh
1
2
3
curl -X POST http://127.0.0.1:8000/api/check-url \
-H "Content-Type: application/json" \
-d '{"url": "http://suspicious-site.xyz"}'
{}response.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
{
"url": "http://suspicious-site.xyz",
"is_safe": false,
"risk_score": 0.87,
"risk_level": "critical",
"threats_detected": [
"virustotal_malicious",
"suspicious_tld",
"very_young_domain"
],
"recommendation": "dangerous — phishing likely",
"breakdown": {
"blacklist_score": 0.90,
"pattern_score": 0.75,
"domain_score": 0.80,
"ml_score": 0.91
},
"domain_age_days": 12,
"ml_score": 0.91
}
Response Fields
is_safebooleanFalse if URL is classified as phishing
risk_scorefloat 0–1Weighted aggregate across all 4 layers
risk_levelstringsafe / low / medium / high / critical
threats_detectedstring[]Threat signal identifiers found
breakdownobjectPer-layer scores: blacklist, pattern, domain, ml
domain_age_daysintegerDomain age in days, null if unknown
ml_scorefloat 0–1ML classifier confidence (phishing probability)
recommendationstringAction guidance based on risk level