Web Monitoring
Phishing, Impersonation & Gambling Site Detection
Phishing, Impersonation & Gambling Site Detection
// Overview
A production module inside a Security Command Center (SCC) platform that hunts suspicious websites abusing the organization's brands, phishing clones, fake portals, brand-jacking gambling sites, by having an AI agent actually open the page, read its HTML, take a screenshot, reason over both, and return an explainable verdict that feeds the takedown queue.
// Background
The challenge
Suspicious domain feeds surface hundreds of alerts.
Most are noise, genuine threats need real page visits.
Most flagged domains weren't threats
Dead sites, unrelated domains, and the brand's own
properties drowned genuine phishing and gambling sites.
Genuine threats hidden in a sea of dead links
You have to look to know
A domain name tells you little; the threat is in the
rendered page, a cloned login form, a fake promo.
The page reveals what the domain name hides
Screenshots needed interpretation
Even with a screenshot, deciding 'is this impersonation
or the real thing?' is a visual judgment that didn't scale.
Visual judgment can't be automated without AI
Gambling/brand-jacking its own category
Brand-hijacking gambling sites needed distinct recognition;
lumping them under 'suspicious' made them unmeasurable.
A major brand-abuse category with no dedicated treatment
Net effect
Manual review bottlenecked takedown, and brand-jacking
gambling sites had no dedicated handling at all.
// Solution
Web threat detection, agentic page inspector
Data sources
Brand-protection feed
suspicious domain alerts
ingest → raw landing
Brand knowledge base
official domains · products
Qdrant vector index
Pipeline
Ingest
Airflow · ingest
raw landing
Ingest
Classify
BERT · Ray Serve
multi-worker
Classify
AI Agents
browser + LLM
vision + RAG
Investigate
Materialize
atomic swap
campaign cluster
Fact
Portal
Vue 3 + FastAPI
+ feedback
Serve
↳ other alert classes → routed to their own flows
Airflow · BERT precheck (Ray Serve) · browser agent (fetch_html + screenshot + vision + RAG) · atomic swap · feedback
// Impact
Investigation: manual → agent
Before · by hand
open · read · screenshot · by handAfter · browser agent
agent reads HTML + screenshot, judges6
verdict classes, explainable
Operational impact
Investigation automated
agent reads + screenshots at scale
Multimodal precision
HTML + screenshot catches visual clones
Gambling verdict class
brand-hijack gambling sites surfaced
Grounded decisions
official-site RAG → auditable verdicts
Closed loop to takedown
confirmed sites → takedown queue
Every run traced
steps replayable · overrides kept
Results
verdict classes
6
evidence-backed
100%
steps / site
~5
autonomous review
24/7
Verdict · scores · screenshot · keywords
All agent steps replayable in portal.
// Tech Stack
| Layer | Technologies |
|---|---|
| Orchestration | Apache Airflow (ingest → precheck → analyze → fact stages), Papermill |
| Ingestion | Commercial brand-protection feed, Python requests, pandas |
| ML precheck | Fine-tuned BERT (Transformers), MLflow (champion), Ray Serve |
| Analysis agent | DSPy ReAct agent, LLM reasoning, tools: fetch_html + screenshot_and_describe (headless Chromium / Playwright-CDP) + vision LLM, Qdrant brand-knowledge RAG, Laminar trace capture |
| Data store | PostgreSQL (raw landing + OLAP fact tables), psycopg / SQLAlchemy |
| Backend API | FastAPI, in-memory CacheStore, async workers |
| Frontend | Vue 3, Quasar, Vite, TypeScript, Pinia, TanStack Vue Query, ECharts |
// Architecture & Diagrams
Suspicious URLs and domains are investigated live by an AI agent that gathers four independent signals and resolves them into a single evidence-backed verdict.
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.