Problem
Paste a raw email and PhishGuard inspects SPF/DKIM alignment, sender spoofing, link domains, and social-engineering language to produce a weighted phishing verdict.
Email SecuritySPF/DKIMNLP HeuristicsAnti-PhishingPythonCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Paste a raw email and PhishGuard inspects SPF/DKIM alignment, sender spoofing, link domains, and social-engineering language to produce a weighted phishing verdict.
Architecture
The implementation combines the following technologies and system concerns.
Email SecuritySPF/DKIMNLP HeuristicsAnti-PhishingPython
How it was built
- Parsed raw email including headers, so analysis works on the actual message rather than on a rendered preview.
- Evaluated SPF, DKIM, and DMARC alignment, which is where most consumer phishing checks stop short and get the verdict wrong.
- Detected display-name spoofing, lookalike domains, and reply-to mismatches against the visible sender.
- Extracted and scored link destinations separately from link text, since the mismatch between them is the classic phishing tell.
Security decisions
- Applied language heuristics for urgency, authority pressure, and payment redirection, weighting them below the authentication signals.
Major challenges
- Parsed raw email including headers, so analysis works on the actual message rather than on a rendered preview.
- Evaluated SPF, DKIM, and DMARC alignment, which is where most consumer phishing checks stop short and get the verdict wrong.
- Detected display-name spoofing, lookalike domains, and reply-to mismatches against the visible sender.
Verified evidence
Results and measurable impact
- Detected display-name spoofing, lookalike domains, and reply-to mismatches against the visible sender.
- Extracted and scored link destinations separately from link text, since the mismatch between them is the classic phishing tell.
- Applied language heuristics for urgency, authority pressure, and payment redirection, weighting them below the authentication signals.
- Produced a weighted verdict that names each contributing signal, so an analyst can disagree with the score on evidence.
No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
phishguard.zainkhalilkhan.com
PhishGuard
Security platform
Sandbox telemetry
PhishGuardWorkspace5 updates
PhishGuard · Email Analyzer
Every heuristic runs live in your browser: authentication headers, sender identity, link destinations, and language are scored against a weighted model. Pick a preset or paste any raw email.
Body · social-engineering phrases highlighted
Dear valued customer, We detected unusual activity on your account. You must verify your identity within 24 hours or your account will be permanently suspended. Act now: [Verify My Account](http://paypal.account-verify.ru/login?id=8842) Failure to act immediately will result in permanent loss of funds.
100risk
Phishing
Authentication
spf=faildkim=nonedmarc=fail
Sender identity
"PayPal Security" <service@paypa1-secure.com> · replies → account-alerts.ru
Display name claims "PayPal Security" but the address is @paypa1-secure.com, not paypal.com
| Anchor text | Actual destination | Assessment |
|---|---|---|
| Verify My Account | paypal.account-verify.ru | "paypal" appears in host but the registered domain is account-verify.ru |
| Signal | Weight | Score | Finding |
|---|---|---|---|
| Email authentication (SPF/DKIM/DMARC) | 25 | +25 | 2 authentication checks failed, the sending server is not authorized for this domain. |
| Display name vs envelope mismatch | 20 | +20 | Display name claims "PayPal Security" but the address is @paypa1-secure.com, not paypal.com |
| Reply-To / Return-Path redirection | 15 | +15 | Replies are routed to account-alerts.ru, a different domain than the From address. |
| Deceptive or lookalike links | 20 | +20 | "paypal" appears in host but the registered domain is account-verify.ru |
| Urgency / social-engineering language | 12 | +12 | 8 pressure phrases found: "immediately", "act now", "within 24 hours", "verify your identity"… |
| Threats or secrecy demands | 8 | +8 | Threatens irreversible consequences to force compliance. |
Phishing · 100/100
Delete this email and report it to your security team. Do not click any links.
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.