Quick+ PhishGuard — AI Phishing Detection & Safe Browser
An Android app with a built-in safe browser that evaluates every URL before the page loads and picks a browsing mode proportional to the risk (Normal / Protected / Warn / Block). Detection is layered: an on-device Dart heuristic risk engine (instant, private) plus a cloud check that combines community-sourced patterns, lexical URL heuristics, and a fine-tuned BERT phishing model — merged by a policy controller with fail-safe defaults. It also scans clipboard text and notifications and runs a community report-and-verify network.
1 / 1Overview
Overview
Quick+ PhishGuard is an Android app whose centerpiece is a built-in safe browser: it evaluates every URL before the page loads and selects a browsing mode (Normal / Protected / Warn / Block) proportional to the risk, tuned for India's scam landscape (KYC, UPI, OTP, banking fraud). It's backed by a clean-architecture FastAPI service and a community threat network.
How the safe browser protects you
- URL interception + real-time scan — navigations are intercepted pre-commit in a flutter_inappwebview WebView via shouldOverrideUrlLoading; a full-screen interstitial blocks or warns with a plain-English "why".
- On-device (instant, private) → cloud (deep) — a pure-Dart heuristic risk engine runs first with no network; unless the result is decisive, the app also calls the backend, and a policy controller merges the two scores with fail-safe defaults (block ≥ 0.85, warn ≥ 0.55).
Detection pipeline
- Signals — lexical / host heuristics (IP-host, punycode, mixed-script, Levenshtein typosquat vs 18 brands, suspicious TLDs, shorteners, urgency language) plus a Hive allow/blocklist on-device; community-sourced patterns + heuristics on the backend.
- Model — the cloud verdict uses a fine-tuned BERT phishing model via the Hugging Face Inference API, with a heuristic + community-pattern fallback.
- Community shield — users report scams, peers vote, and confirmed reports are promoted into shared detection patterns.
Backend
FastAPI (clean / DDD) · PostgreSQL via Prisma · Redis (cache + rate-limit + idempotency) · Celery jobs · JWT RS256 with refresh-token rotation & reuse detection · bcrypt · per-endpoint rate limiting · audit logging.
Architecture
Flutter safe-browser client → on-device heuristic engine → FastAPI /scan → community patterns (Redis) + heuristics + hosted BERT → verdict → policy merge → interstitial. Deployed with Docker Compose and GitHub Actions CI/CD.
How it came together
Phishing and scam links (fake KYC, UPI, bank-verification, OTP-theft and reward messages) reach people through SMS, WhatsApp, email and the browser and cost victims money and credentials — a severe problem in India. Mainstream mobile browsers give no proactive, pre-navigation warning tuned to these local scam patterns.
An Android app with a built-in safe browser that evaluates every URL before the page loads and picks a browsing mode proportional to the risk (Normal / Protected / Warn / Block). Detection is layered: an on-device Dart heuristic risk engine (instant, private) plus a cloud check that combines community-sourced patterns, lexical URL heuristics, and a fine-tuned BERT phishing model — merged by a policy controller with fail-safe defaults. It also scans clipboard text and notifications and runs a community report-and-verify network.
Built a working guest-first safe-browser core with pre-navigation phishing interception and block/warn interstitials, on a hardened FastAPI backend (JWT RS256 with refresh-token rotation & reuse detection, rate limiting, Redis caching, Celery jobs, GitHub Actions CI/CD), covered by ~30 backend and 40+ mobile unit/integration tests.