Zero-Day Phishing Threat Intelligence Platform
Enterprise-grade automated threat intelligence platform combining a FastText NLP classifier, structured ML models, and algorithmic distance rules to identify deceptive URLs and brand spoofing for client security teams at NetSTAR Global.
Problem
Client security teams were drowning in zero-day phishing URLs. Attackers rotate domains faster than blocklist-based tools can react, and brand spoofing sites often evade signature detection entirely — forcing analysts to triage deceptive links by hand. NetSTAR needed a platform that could score a URL as a potential zero-day threat in near real time and feed that signal into a dashboard their security teams actually watched.
Approach
Built a hybrid detection architecture instead of betting on a single model: a FastText NLP classifier for URL semantics, structured ML models over hand-engineered features, and algorithmic distance rules to catch brand-spoofing variants.
Analyzed 1B+ phishing URLs with SQL to train and validate the ensemble (XGBoost, LightGBM, Random Forest, Logistic Regression) against real threat telemetry rather than synthetic samples.
Integrated the NetSTAR and PhishStats APIs so zero-day evaluations are dynamically enriched with fresh threat context instead of relying on a static corpus.
Orchestrated the whole platform in a containerized environment (Docker) so the pipeline and its Power BI telemetry layer deploy identically across client environments.
Quantized the FastText classifier to int8 (per-row scale) and shipped it as an edge endpoint (POST /api/classify), so the model itself is testable live from a browser — the demo on this page runs that exact artifact.
Outcome
~96%
Detection accuracy
on zero-day phishing threats with the ML ensemble (XGBoost, LightGBM, Random Forest, Logistic Regression)
1B+
URLs analyzed
phishing URLs processed through SQL pipelines to train models and drive live telemetry
Real-time
Response mode
containerized pipeline feeding a live Power BI dashboard for enterprise client security teams
Live Demo
The classifier below is the FastText model from this project, retrained from the NetSTAR-labeled URL corpus and quantized to int8 so it runs entirely on the edge. The live demo is temporarily offline for backend work and will be back soon — the research and architecture on this page are unaffected.
Live demo is temporarily offline for backend work — coming back soon.
The research, architecture, and evaluation on this page are unaffected. The classifier and its example URLs will return once the model backend is back up.
Pipeline
01
Training
The FastText classifier trained on 1B+ phishing URLs — 90 epochs, then int8-quantized so it runs on the edge. Train loss falls from 1.77 to 0.09; validation settles at 0.16.
Scroll slowly — the descent is the point. Every epoch eats a little more of the loss surface.
02
Where it fails
Subword tokenization handles unseen domains, but [UNK] still slips past — these are the ones we miss.
Each dot is a URL the classifier got wrong on the held-out split. Color is the class that slipped through — a missed phish costs more than a false alarm, so recall is the number to watch.
03
How we measured
A held-out split of 4,409 URLs, stratified by class and never seen during training.
Overall accuracy on the split: 96.7%. The bars scrub in as you scroll.
Precision — of everything we flagged, this share was actually phishing
Recall — of actual phishing URLs, this share we caught
F1 — harmonic mean — the balanced score
04
What it costs
Deploying this costs almost nothing to operate: the whole model is a static import on Cloudflare Workers — no GPU, no Python, no external API calls.
Static figures from the deployed artifact.
~518 KB
Edge model — int8 FastText
static module import on Cloudflare Workers; no Python, no GPU, no external calls
~5 ms
Inference latency (p50)
single in-memory matrix multiply over the hashed URL tokens
Evaluation
The ~96% accuracy figure comes from evaluating the ensemble against held-out zero-day phishing samples during training. The strongest gains came from the hybrid combination: FastText caught semantically deceptive URLs that structured models missed, while distance rules closed the gap on domain typo-squatting that neither model was explicitly trained on. The live demo on this page runs the FastText component retrained from the same corpus and measured on the deployed artifact: 96.7% accuracy, 94.1% phishing recall, and 99.3% precision on a held-out 4,409-URL split (stratified by class, unseen during training). The int16 quantization that lets the model run on the edge costs nothing measurable in accuracy — you are interacting with the deployed artifact, not a screenshot of it. It is still a URL-text-only model: it sees structure and brand tokens, never page content, so treat edge cases as signals, not verdicts.
What I'd Do Differently
I would instrument the pipeline with explicit offline evaluation harnesses earlier. Accuracy on zero-day samples was measured retrospectively rather than continuously, which made it harder to prove which component contributed each gain. I would also push harder on explainability artifacts — security teams trust a verdict more when they can see the rule or feature that triggered it, and that would have shortened the path from detection to analyst action.
Tech Stack
Building something similar?
Let's talkRelated Projects
Distributed Medallion Lakehouse integrating cross-ministry CSR, groundwater, and education datasets using Apache Spark and Iceberg for panel regression analysis of Indian state-level policy outcomes.
Led the team migration of Ericsson's Citrix virtual infrastructure — 2,000+ production servers — from on-prem to Google Cloud Platform, one of the company's largest public cloud modernization initiatives, with hardened hybrid security and automated database operations.
End-to-end ELT streaming pipeline that ingests real-time Twitch viewership data through Apache Kafka, warehouses in Snowflake, and transforms with dbt for Looker Studio dashboards.