🛡️ AutoPhisNet

Automated Phishing URL Detection & Prevention System

AutoPhisNet is a cybersecurity system designed to detect and prevent phishing websites in real time.

The project combines Machine Learning, URL feature analysis, brand impersonation detection, VirusTotal threat intelligence, browser navigation interception, and risk-based decision making to provide an additional layer of protection against malicious and phishing websites.

🚀 Key Features

🔍 Real-time phishing URL detection
🤖 Machine Learning-based URL classification
🧠 Rule-based URL analysis
🎯 Brand impersonation detection
🌐 VirusTotal threat intelligence integration
🚨 Automatic browser navigation monitoring
🛑 Suspicious and high-risk URL interception
⚠️ Dedicated phishing warning page
↪️ One-time "Proceed Anyway" bypass
📊 Security monitoring dashboard
💾 SQLite-based scan history
🧩 Chrome Manifest V3 extension
⚡ FastAPI-based backend

🏗️ System Architecture

User → Chrome Extension → FastAPI Backend
                         ↓
        URL Features + ML + Brand + VirusTotal
                         ↓
                    Risk Scoring
                         ↓
             SAFE / SUSPICIOUS / HIGH_RISK
                         ↓
              Allow / Warn / Block

🔬 How AutoPhisNet Works

User visits website
        ↓
Browser extension detects navigation
        ↓
URL sent to FastAPI backend
        ↓
URL feature extraction
        ↓
Machine Learning prediction
        ↓
Brand impersonation analysis
        ↓
VirusTotal threat intelligence
        ↓
Risk score calculation
        ↓
SAFE / SUSPICIOUS / HIGH_RISK

🧠 Detection Methodology

1. URL Feature Analysis

AutoPhisNet extracts URL characteristics such as:

URL length
Domain characteristics
Number of subdomains
Suspicious keywords
Special characters
IP address usage
HTTPS usage
Path characteristics
Query parameters
Domain structure
Other phishing-related indicators

2. Machine Learning Detection

AutoPhisNet uses a trained machine learning model to estimate the probability that a URL belongs to a phishing or legitimate category.

The model was trained using the PhiUSIIL Phishing URL Dataset.

Custom URL-based features are extracted before prediction. The ML result is combined with other security signals.

3. Brand Impersonation Detection

AutoPhisNet analyzes suspicious domain names for possible impersonation of known brands.

Example test URL:

https://paypal-login-security.com/verify/account?id=123

Observed result:

Risk Score: 70/100
Verdict: HIGH_RISK
Brand Analysis: paypal (100%)
ML Probability: 100%

4. VirusTotal Threat Intelligence

AutoPhisNet can query VirusTotal for additional threat intelligence. VirusTotal is treated as an additional security signal rather than the sole basis for the final verdict.

🚦 Risk Classification

Verdict	Description	Action
🟢 `SAFE`	No significant indicators detected	Allow navigation
🟡 `SUSPICIOUS`	Potentially dangerous indicators detected	Show warning
🔴 `HIGH_RISK`	Strong phishing/malicious indicators detected	Block navigation

🛑 Automatic Browser Protection

The Chrome extension monitors main-frame browser navigation.

SAFE

The website is allowed to load normally.

SUSPICIOUS

The user is redirected to the AutoPhisNet warning page.

HIGH_RISK

The navigation is intercepted and the user is shown a high-risk warning page.

⚠️ Warning Page

The AutoPhisNet warning page displays:

Risk score
Detected URL
Detection reasons
ML probability
Brand analysis
VirusTotal information
Go Back
Proceed Anyway

↪️ One-Time Bypass

The Proceed Anyway option provides a temporary, one-time bypass.

Warning Page
      ↓
Proceed Anyway
      ↓
One-Time Bypass
      ↓
Navigation Allowed
      ↓
Bypass Removed

The same URL is scanned again during a future navigation.

📊 Security Dashboard

The dashboard provides:

Total scans
Safe URLs
Suspicious URLs
High-risk URLs
Scan history
Search and filtering
Risk distribution
Pagination
Automatic refresh

Scan information is stored locally using SQLite.

🧩 Browser Extension

AutoPhisNet uses Chrome Extensions Manifest V3.

Main components:

background.js — monitors navigation and communicates with the backend
popup.html / popup.js — displays scan information and scanner status
warning.html / warning.js — displays security warnings
manifest.json — extension configuration and permissions

📁 Project Structure

AutoPhisNet/
│
├── backend/
│   ├── data/
│   ├── models/
│   ├── app.py
│   ├── scanner.py
│   ├── train_model.py
│   ├── prepare_dataset.py
│   ├── evaluate_model.py
│   ├── ml_features.py
│   ├── test_scanner.py
│   ├── download_dataset.py
│   └── requirements.txt
│
├── extension/
│   ├── background.js
│   ├── manifest.json
│   ├── popup.html
│   ├── popup.js
│   ├── warning.html
│   └── warning.js
│
├── dashboard/
│   ├── index.html
│   └── dashboard.js
│
├── .env.example
├── .gitignore
├── LICENSE
├── PROJECT_NOTES.md
└── README.md

⚙️ Installation

Requirements

Windows 10/11
Python 3.10 or newer
Google Chrome
Git
Internet connection
VirusTotal API key (optional)

Check Python:

python --version

Check Git:

git --version

1. Clone the Repository

git clone https://github.com/Maverickk96/AutoPhisNet.git
cd AutoPhisNet

2. Create a Python Virtual Environment

python -m venv backend\.venv

3. Activate the Virtual Environment

backend\.venv\Scripts\activate

You should see (.venv) in your terminal prompt.

4. Upgrade pip

python -m pip install --upgrade pip

5. Install Dependencies

pip install -r backend\requirements.txt

🔐 Environment Configuration

VirusTotal integration requires an API key.

Create:

backend/.env

PowerShell:

New-Item backend\.env -ItemType File

Add:

VIRUSTOTAL_API_KEY=your_api_key_here

Use the actual API key without quotes.

Correct:

VIRUSTOTAL_API_KEY=abc123yourkey

Do not use PowerShell syntax inside .env:

$env:VT_API_KEY="abc123yourkey"

🔒 Protect Your API Key

Never upload your real .env file to GitHub.

Only .env.example should be committed:

VIRUSTOTAL_API_KEY=your_api_key_here

▶️ Running the Backend

From the project root:

cd backend

Activate the environment if necessary:

.\.venv\Scripts\activate

Start FastAPI:

uvicorn app:app --reload

The backend runs at:

http://127.0.0.1:8000

🩺 Verify the Backend

Health check:

http://127.0.0.1:8000/health

Interactive API documentation:

http://127.0.0.1:8000/docs

🧩 Install the Chrome Extension

Open Google Chrome.
Go to chrome://extensions.
Enable Developer mode.
Click Load unpacked.
Select:

AutoPhisNet/extension/

Enable AutoPhisNet.

The extension will monitor browser navigation and communicate with the local FastAPI backend.

📊 Run the Dashboard

Make sure the backend is running.

Open:

dashboard/index.html

The dashboard communicates with:

http://127.0.0.1:8000

🧪 Testing

AutoPhisNet was tested against all three risk categories.

🟢 SAFE

https://www.google.com/

Expected:

SAFE
↓
Navigation allowed

🟡 SUSPICIOUS

Expected:

SUSPICIOUS
↓
Warning Page

The one-time Proceed Anyway functionality was also tested successfully.

🔴 HIGH-RISK

https://paypal-login-security.com/verify/account?id=123

Observed:

Risk Score: 70/100
Verdict: HIGH_RISK
Brand Analysis: paypal (100%)
ML Probability: 100%

Expected:

HIGH_RISK
↓
Navigation intercepted
↓
AutoPhisNet Warning Page

🔄 End-to-End Workflow

                    User
                     │
                     ▼
               Opens Website
                     │
                     ▼
             Chrome Extension
                     │
                     ▼
             Navigation Detected
                     │
                     ▼
               FastAPI /scan
                     │
                     ▼
            URL Feature Extraction
                     │
          ┌──────────┼──────────┐
          ▼          ▼          ▼
         ML       Brand      VirusTotal
       Analysis   Analysis    Intelligence
          │          │          │
          └──────────┼──────────┘
                     ▼
                Risk Scoring
                     │
          ┌──────────┼──────────┐
          ▼          ▼          ▼
        SAFE     SUSPICIOUS   HIGH_RISK
          │          │          │
          ▼          ▼          ▼
        Allow      Warning      Block

🛠️ Technologies Used

Programming

Python
JavaScript
HTML
CSS

Backend

FastAPI
Uvicorn
SQLite

Machine Learning

Scikit-learn
Pandas
NumPy
Joblib

Cybersecurity

Phishing URL Detection
URL Feature Analysis
Brand Impersonation Detection
Threat Intelligence
Risk Scoring
Browser Security

Browser Technology

Chrome Extensions Manifest V3
Chrome WebNavigation API
Chrome Storage API

🔐 Security Practices

API keys are stored using environment variables.
.env is excluded from version control.
Local databases are excluded from Git.
Python virtual environments are excluded from Git.
Browser-internal URLs are ignored.
High-risk navigation is intercepted.
Proceed Anyway uses a one-time bypass.
Detection uses multiple security signals.

🔮 Future Enhancements

Real-time phishing feed integration
Additional threat intelligence providers
Advanced domain reputation analysis
Improved false-positive handling
URL reputation caching
Configurable risk thresholds
Cloud-based security dashboard
Automated security reports
Enterprise deployment
Enhanced analytics
Support for additional browsers

🎯 Project Objective

The primary objective of AutoPhisNet is to provide an additional defensive layer against phishing websites by combining automated URL analysis, machine learning, threat intelligence, and browser-level protection.

The project demonstrates the integration of:

Machine Learning
        +
Cybersecurity
        +
Threat Intelligence
        +
Browser Security
        +
API Development
        +
Security Automation

into a practical phishing detection and prevention system.

⚠️ Disclaimer

AutoPhisNet is an educational and research-oriented cybersecurity project.

Detection results are security indicators and should not be considered guaranteed classifications.

Users should continue following standard cybersecurity practices and avoid entering sensitive information on websites they do not trust.

📄 License

This project is licensed under the MIT License.

See the LICENSE file for more information.

👨‍💻 Author

Maverickk96

GitHub: https://github.com/Maverickk96

Name		Name	Last commit message	Last commit date
Screenshots		Screenshots
backend		backend
dashboard		dashboard
extension		extension
.env.example		.env.example
.gitignore		.gitignore
LICENSE		LICENSE
PROJECT_NOTES.md		PROJECT_NOTES.md
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

🛡️ AutoPhisNet

Automated Phishing URL Detection & Prevention System

🚀 Key Features

🏗️ System Architecture

🔬 How AutoPhisNet Works

🧠 Detection Methodology

1. URL Feature Analysis

2. Machine Learning Detection

3. Brand Impersonation Detection

4. VirusTotal Threat Intelligence

🚦 Risk Classification

🛑 Automatic Browser Protection

SAFE

SUSPICIOUS

HIGH_RISK

⚠️ Warning Page

↪️ One-Time Bypass

📊 Security Dashboard

🧩 Browser Extension

📁 Project Structure

⚙️ Installation

Requirements

1. Clone the Repository

2. Create a Python Virtual Environment

3. Activate the Virtual Environment

4. Upgrade pip

5. Install Dependencies

🔐 Environment Configuration

🔒 Protect Your API Key

▶️ Running the Backend

🩺 Verify the Backend

🧩 Install the Chrome Extension

📊 Run the Dashboard

🧪 Testing

🟢 SAFE

🟡 SUSPICIOUS

🔴 HIGH-RISK

🔄 End-to-End Workflow

🛠️ Technologies Used

Programming

Backend

Machine Learning

Cybersecurity

Browser Technology

🔐 Security Practices

🔮 Future Enhancements

🎯 Project Objective

⚠️ Disclaimer

📄 License

👨‍💻 Author

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages