AI Phishing Detection Tool

Overview

Most phishing filters are either rigid rule sets that miss creative attacks, or opaque ML models that can’t explain themselves. This project combines both approaches: fast, explainable deterministic checks and a Claude LLM semantic pass that reads the email the way a human analyst would.

How it works

• Heuristic layer — checks SPF, DKIM and DMARC results, sender/display-name mismatches, and analyzes URLs inside the message.
• LLM layer — a Claude semantic pass evaluates intent, urgency and impersonation cues.
• Output — a verdict, a risk score, a plain-English rationale, and the exact risky spans highlighted in the email.

Attacker / defender loop

To measure the detector honestly, I built the other side too:

• A red-team generator that produces synthetic phishing look-alike emails at three difficulty tiers, each with planted ground truth.
• Generated emails are delivered only to an isolated Mailhog sandbox or the operator’s own Gmail inbox — never to third parties.
• A scorecard joins ground truth to detector verdicts to report catch rate and false-positive rate by difficulty tier.

Interfaces

• A React UI for submitting emails and reviewing results.
• A Chrome extension that scores live Gmail messages in place.