Phishing detection that never leaves your laptop
History-Aware Phishing Detection
Yousef AbuHashem and Zakir Durumeric. Stanford CS Senior Project, 2025.
One of my favorite professors, Prof. Keith Winstein, would tell us “think of the dumbest thing possible”.
In the context of phishing detection, I thought well if we do not visit that many new domains, what if we got a small alert when our browser notices we are at a completely new domain?
Here is a fact I found delightful: over any two week stretch, the median person visits about 34 domains. Not 34 pages. 34 domains. And the set barely changes from month to month.
Which means your browsing history is a pretty tight description of where you actually go on the internet. So when you land on a domain you have never visited before, and that domain happens to look a lot like your bank, that is not just suspicious. It is statistically weird.
That is the whole idea here. Instead of asking “is this domain on a blacklist,” ask “has this person ever been here before, and is it pretending to be somewhere they go all the time?”
Why bother, when blacklists exist
Blacklists, URL heuristics, and server-side scanners all share three problems. They cannot catch a domain registered five minutes ago. They usually require shipping your browsing somewhere. And they treat everybody identically, even though everybody’s internet is different.
History-based detection sidesteps all three, more or less by construction.
Heads up: the chart below is a qualitative analysis, which is the academic way of saying vibes. It is my honest read of the trade-offs, not a benchmark.
Does it actually work
I tested it against anonymized browsing data from 844 real users.
- History only
- 100% recall
- History plus a popular-domain whitelist
- 97.74% recall, better precision
- Users in the dataset
- 844
The history-only approach caught every single phishing domain, which makes sense once you say it out loud: a phishing domain is by definition one you have never been to. The interesting engineering question is not recall, it is how to stop flagging every legitimate new site you visit. That is what the whitelist buys, at the cost of a little purity.
PhishGuard
To prove it works outside a spreadsheet, I built the extension. It scores how familiar each domain is based on your own history, and flags first-time visits to domains impersonating services you actually use. You can opt into extra layers on top (URL analysis, form security, content checks), but the core engine runs locally and nothing ever leaves the machine.
Private by construction
Nothing to upload, because the signal already lives in your browser. No third party learns where you go.
Zero-day by default
A domain registered five minutes ago is new to you, so it gets flagged. No list needs to hear about it first.
Adapts on its own
Your habits change, the model of "normal" changes with them. Nothing to update or retrain.
The honest limitation: I ran out of runway on IRB approval, so there is no user study behind this. Everything above is validated against historical data, not against real people encountering real phishing in the wild. That is the next thing this needs, and it is the thing that would actually settle it.
There is also a genuine tension I did not fully resolve. Bolting on a global whitelist improves the numbers but chips away at the pure personalization argument. Defaulting to a million whitelisted domains is probably too many. Finding the right size for that list is real work, and it is where I would start if I picked this back up.