Back to projects
Production ML / DNS security
Case StudyML Phishing Domain Detection
A production machine-learning system that screens live DNS traffic and flags malicious or look-alike phishing domains in near real time. A four-model ensemble over 50+ engineered domain features is backed by a multi-stage verification safety net that confirms threats and suppresses false positives before they block a real customer. It flags roughly 800 malicious domains a day at about 90% precision. Built at ThreatSTOP.
Built at ThreatSTOP
Proprietary production system—not publicly deployable. Described here from its architecture, measured results, and my role.
Jump to results →System at a glance
From live DNS traffic to a guarded verdict.
Explore the pipeline, model ensemble, and verification layer behind the production system.
01IngestLive threat feeds + DNS telemetry
→02NormalizeClean and standardize domains
→03EngineerLexical, entropy, TLD + similarity signals
→04InferFour independently tuned models vote
→05VerifyIndependent safety net checks every flag
The fitted vectorizer and TLD statistics are persisted so production inference reproduces the training feature space.
Random ForestGradient BoostingLogistic RegressionLinearSVC
Agreement producesHigh · Medium · Lowconfidence tier
Each classifier uses its own tuned decision threshold. No single model gets the final word.
Age + structureNew registrations and structural bait patterns
Multi-engine reputationIndependent consensus from VirusTotal
Signal scoringWHOIS, infrastructure, and lexical cues
Confirmed maliciousNeeds reviewMonitorBenign
Every verdict becomes labeled data for monitoring and the next model retrain—the safety net is also the data flywheel.
Why it mattered
Phishing domains appear faster than a human-maintained blocklist can keep up. I built this system to catch them from live threat feeds and DNS traffic—without blocking legitimate customer sites.
What I built
- A production pipeline that cleans domains, creates 50+ features, trains four model types, and serves the ensemble in a container.
- Independent decision thresholds for each model, producing high, medium, or low confidence tiers.
- Training data that balances threat feeds with trusted domains, so the models learn both malicious and normal patterns.
The safety net
About 90% precision is strong, but a false positive can still block a real customer’s domain. The model therefore never acts alone.
Every flagged domain goes through three independent checks:
- Registration age and structural bait patterns.
- Multi-engine reputation consensus.
- WHOIS, infrastructure, and lexical signals for ambiguous cases.
The final verdict is confirmed malicious, needs review, monitor, or benign. Reviewed verdicts feed monitoring and future retraining.
Production decisions
- Precision over recall: missing some threats was preferable to incorrectly blocking a legitimate site.
- Repeatable inference: saved vectorizers and TLD statistics keep production features identical to training.
- Operational visibility: Kubernetes, versioned S3 artifacts, Prometheus, Sentry, graceful shutdowns, and continuous false-positive monitoring keep the system observable and recoverable.
Results
- Screens a live stream of customer DNS traffic every few minutes.
- Flags and blocks roughly 800 malicious or suspicious domains per day.
- Measures about 90% precision on live traffic against the safety net's verdicts.
Key challenges
- Tuning for a strict precision floor because a false positive can block a real customer's legitimate domain.
- Keeping production inference identical to training by persisting the fitted vectorizer and TLD statistics.
- Turning verification verdicts into a continuous false-positive monitoring and retraining loop.
Case study / Discussion
Ask me about the engineering decisions.
I can discuss my role, architecture, evaluation, safeguards, and operational tradeoffs without sharing proprietary implementation details.