Two signals, not one
The classifier reads language and intent; the threat feeds read reputation. Either alone produces false positives a user will learn to dismiss — together they are worth interrupting someone for.
All projects
PhishShield-AI
Catching the phishing emails that look legitimate, in real time.
Source is private — happy to walk through the architecture on a call.
85%
accuracy improvement over baseline
2
live threat feeds integrated
Inline
real-time scoring in the inbox
A Chrome extension pairing a trained classifier with live threat intelligence to score phishing attempts before the user clicks.
Why it mattered
Generative models made convincing phishing cheap. Filters tuned on the old signals — bad grammar, obvious spoofs — do not catch a well-written, contextually plausible message, and that is now the common case.
The problem
Phishing drives the majority of breaches. Existing tools reliably catch obvious spam, but far fewer catch AI-generated, contextually convincing attacks in the seconds before someone clicks.
What I built
- Random Forest classifier trained for phishing email detection, delivering an 85% accuracy improvement over the baseline it replaced.
- Live threat intelligence from VirusTotal and URLHaus for proactive URL mitigation.
- Chrome extension surfacing inline threat scoring, backed by a Flask service.
- Hugging Face models for NLP-based content analysis of message intent.
Engineering notes
Scoring inline, not after the fact
A warning that arrives after the click is a post-mortem. The extension scores in the reading pane so the decision point and the warning are in the same place.
Curious about any of this?
I am glad to go deeper on the architecture, the tradeoffs, or the parts that did not work the first time. That conversation is usually more useful than the README.