MailShield – AI-Powered Phishing Defense
GitHubAutomated phishing detection system for email and URL analysis targeting enterprise spam filter gaps.
Overview
MailShield acts as an advanced supplementary email gateway. It analyzes email headers, domain reputation, and body text using NLP heuristics to catch sophisticated spear-phishing attempts that bypass standard filters.
The Problem
High-velocity phishing attacks bypassing traditional spam filters, leading to credential theft and malware delivery within organizations.
System Architecture
Python daemon that monitors a catch-all inbox. Emails are parsed, URLs are extracted and sent to VirusTotal/URLScan APIs, and the text is analyzed using Scikit-Learn. Alerts are generated via Slack webhooks.
Engineering Trade-offs
Relied heavily on external APIs (VirusTotal) for URL reputation rather than building a custom crawler, saving development time but introducing a dependency on third-party uptime.
Lessons Learned & Future
Production Learnings
Email parsing is notoriously difficult due to non-standard implementations of MIME types and encoding across different mail clients.
Future Improvements
Developing a custom headless browser sandbox to capture screenshots of suspicious URLs safely.
Database Layer
SQLite for local caching of domain reputations to reduce external API calls and speed up processing.
API Design
Internal REST API for querying domain reputation cache and manually submitting suspicious URLs for analysis.
Security Decisions
1. Email bodies are stripped of active content (HTML, JS) before parsing. 2. External API calls are routed through an anonymous proxy to prevent tipping off attackers that their phishing link is being investigated.
Scale & Metrics
Analyzes and classifies a standard email in under 2.5 seconds.