PHISHGUARD
Start Scanning
Advanced Cybersecurity Project

Stop Phishing Before It
Reaches Your Inbox

An intelligent pipeline analyzing URLs and emails with multi-layer detection, real-time threat intelligence mapping, and local AI analysis.

Try Scanner View Threat Map

Live Analysis Gateway

Paste a suspicious URL or email — type, paste, or attach a file. One box, works on any device.

Full header check needs the .EML file
How to check an email — pick whichever suits your device:
 
📱 On a phone (recommended)
Open the email → tap Forward → select all the text in the message box and copy it → paste it above → discard the draft without sending.
The forwarded text includes the sender's real address, which lets the scanner check the sending domain.
 
💻 On a computer (deepest scan)
Gmail → three dots (⋮) → "Download message" → attach the .eml file using the button above.
This unlocks DKIM signature verification in addition to everything else.
How It Works

The Multi-Layer Detection Pipeline

Combining heuristic rules, DNS authentication, VirusTotal threat intelligence, local AI analysis, and real-time geolocation mapping.

Lexical Extraction

Evaluates URLs for character abnormalities, subdirectory depths, domain entropy, high-risk TLD alignments, and brand impersonation patterns.

DNS & Authentication

When a full email is provided, queries SPF and DMARC records for the sender domain and checks DKIM signature alignment alongside domain registration age.

VirusTotal Intelligence

Submits detected URLs to VirusTotal and cross-references against 90+ security vendor databases for reputation-based threat verification.

Local LLM Analysis

A locally hosted Llama 3.1 model provides contextual semantic analysis of message content without sending sensitive data to external cloud services.

Works on Any Device

A single input accepts either pasted text or an attached .eml file, so mobile users get instant checks and desktop users get full header-level analysis.

Threat Intelligence Map

Every detected threat is geolocated to its server origin and plotted on a live world map, turning individual scan results into collective threat intelligence.