I Built an AI Tool That Flags Suspicious URLs Before You Click

INTRODUCTION

Phishing attacks remain one of the most common cyber threats. Attackers create malicious websites that mimic legitimate services to steal credentials and sensitive information.

To understand how machine learning can help identify phishing websites, I built CyberGuard, a command-line phishing URL detection tool using Python and Random Forest classification.

Problem Statement

Traditional blacklists cannot detect newly created phishing websites.

The goal was to create a lightweight tool that can:

• Analyze URLs
• Extract phishing indicators
• Predict whether a URL is legitimate or phishing
• Run locally from the command line

Dataset

I used a publicly available phishing website dataset containing features such as:

UsingIP
LongURL
ShortURL
Symbol@
Redirecting//
PrefixSuffix-
SubDomains
HTTPS
DomainRegLen
Favicon
NonStdPort
...
StatsReport
class

The dataset labels:

1  -> Phishing
-1 -> Legitimate

Machine Learning Model

The project uses:

RandomForestClassifier

Why Random Forest?

• High accuracy
• Handles feature interactions well
• Resistant to overfitting
• Easy to interpret

Training Process

The workflow:

Dataset
 ↓
Preprocessing
 ↓
Train-Test Split
 ↓
StandardScaler
 ↓
Random Forest
 ↓
model.pkl

Training code:

model = RandomForestClassifier(
    n_estimators=300,
    random_state=42
)

Building CyberGuard CLI

The tool accepts a URL as input:

python cyberguard_cli.py https://example.com

The workflow:

URL
 ↓
Feature Extraction
 ↓
Scaler
 ↓
ML Model
 ↓
Prediction

Feature Extraction

CyberGuard extracts indicators such as:

• IP-based URLs
• URL length
• Suspicious symbols (@)
• Redirect patterns
• Subdomain count
• HTTPS usage
• Domain anomalies

Example:

def has_ip(url):
    ...

Sample Output

Legitimate URL:

python cyberguard_cli.py https://google.com

Output:

SAFE / LEGITIMATE URL

Phishing URL:

python cyberguard_cli.py http://secure-login-verification.xyz

Output:

PHISHING URL DETECTED

Challenges Faced

During development I encountered:

• Dataset feature mismatches
• Feature extraction consistency
• False positives
• Model calibration issues

One major lesson was ensuring that the features used during prediction matched the features used during training.

Future Improvements

Potential enhancements:

• WHOIS lookup integration
• Domain age analysis
• SSL certificate validation
• Threat intelligence feeds
• Web dashboard
• Browser extension
• API integration

The complete source code is available on GitHub for anyone interested in experimenting with the project or extending its functionality.

*🔗 GitHub Repository:* abhi-lash068/CyberGuard: AI Phishing URL Detector by Abhilash H

This project was developed as part of my exploration of practical cybersecurity and machine learning applications. Feedback and contributions are welcome.

If you have suggestions or ideas for improving CyberGuard, feel free to connect with me or contribute to the project.

Conclusion

CyberGuard demonstrates how machine learning can be combined with cybersecurity principles to identify potentially malicious URLs.

While it is not intended to replace enterprise security solutions, it provides a practical example of phishing detection using Python and machine learning.