Phishing Detection Browser Extension
A browser extension that warns about likely phishing pages using features computed locally, without sending browsing history anywhere. The privacy constraint is what makes it interesting, because the obvious implementation is a URL lookup service that watches everything you visit.
Intermediate
A small team, or one strong student willing to learn something new.1 semester, 2 students
5 to ship
3 optional extrasSuggested stack
What you should ship
- Feature extraction from URL structure, page content, form targets and certificate details, computed in the browser
- Classifier trained on public phishing and legitimate URL datasets, exported to run client side
- Warning interface explaining which signals triggered it rather than showing a bare score
- Local allow list and a user reporting path, with reports containing no browsing history
- Evaluation on a held out set with the false positive rate reported prominently
If you have time left
- Visual similarity comparison against known login pages for brand impersonation
- Typosquatting detection by edit distance against a list of popular domains
- Periodic model updates without transmitting any user data
The problem
Phishing remains effective because a convincing copy of a login page is cheap to make and users have no reliable signal. Existing protection typically relies on reputation lookups, which means a service learns every page you visit.
What you build
Local feature extraction, a classifier small enough to run in the browser, and a warning interface that explains itself.
The constraint that shapes the design
No browsing history leaves the device. That rules out the easy approach and forces you to work from features computable locally: the URL structure, the age and issuer of the certificate, where forms submit, whether the page requests credentials, and how the domain compares to well known ones. Making that work is the project.
Why false positives are the number to lead with
A tool that warns on legitimate sites gets uninstalled the same day, and worse, it teaches users to dismiss warnings. Report the false positive rate first and treat it as the primary metric.
The explanation requirement
A generic warning teaches nothing. Saying that this domain was registered four days ago and the login form submits to a different domain both justifies the warning and educates the user, and it is what makes the extension defensible when it is wrong.
Scope warning
Detection only. Do not build blocking, enterprise reporting or an incident dashboard. And be careful handling live phishing URLs during development.
Ideas and guidance, not finished projects
These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.
Not sure this one fits you?
I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Every session is free; a few slots open each week.
Follow along
New writing, resources and project ideas land here first.