Know if a link is phishing
before you click it.
A trained logistic-regression classifier — 34 lexical features over 88,647 labelled URLs — paired with a domain-reputation layer that knows an authentic domain from a one-letter impostor. Scored on your device.
Smart India Hackathon · Government of India
One changed letter is all a scammer needs.
A country of 1.4 billion people gets phished one character at a time — amazon → amozan, flipkart → flipkrat, icici → iccic. The link looks right, the page looks right, and a salary lands in a stranger's account. URL Defender reads the domain the way an analyst would, in the millisecond before the tap.
“It's a new India. It's a smart India.”
Aao, Bharat ko majboot banaye. — Let's go, Smart India Hackathon.
How it actually works
Five honest stages — collection, feature engineering, training, domain reputation, and in-browser inference.
Public corpora
88,647 labelled URLs pulled from the open phishing-dataset corpus mirrored on Kaggle and GitHub, split 58,000 legitimate / 30,647 phishing.
34 lexical features
Symbol counts, segment lengths, subdomain depth, raw-IP hosts, shortener detection and query anomalies. Scheme and trailing slashes are stripped first — they carry no signal.
Domain reputation
The registrable domain is resolved first. Verified domains carry their own deep links; look-alike spellings of a known brand are overridden straight to high risk.
Scored on device
A dot product and a sigmoid. Sub-millisecond, works offline, and your URLs never leave the browser.
Built at Chandigarh University
Team Phoenix took the Cyber Security & Blockchain problem statement at Chandigarh University's SIH 2023 internal round and carried it to the national stage — five friends, 36 hours, one classifier that the judges could break-test live.
Read the full storyPrivacy is the architecture
There is no backend. The model weights are a static JSON file, feature extraction is plain TypeScript, and every verdict is computed inside your tab. Turn off your network and it still works.