History-Aware Phishing Detection

One of my favorite professors, Prof. Keith Winstein, would tell us to “think of the dumbest thing possible.”

So for phishing detection, I thought, well, we don’t visit that many new domains. What if the browser gave us a small alert whenever we landed on a completely new one?

Here’s a fact I found delightful: over any two-week stretch, the median person visits about 34 domains (domains, not pages), and that set barely changes from month to month.

That means your browsing history is a pretty accurate picture of where you actually go online. So if you land on a domain you’ve never visited, and it happens to look a lot like your bank, that’s a good reason to be suspicious.

Instead of asking “is this domain on a blacklist?”, the idea is to ask “has this person been here before, and is this site pretending to be somewhere they go all the time?”

Type a domain, or try one of these:

Your last two weeks (34 domains)

google.com
youtube.com
gmail.com
github.com
stanford.edu
wikipedia.org
reddit.com
amazon.com
netflix.com
spotify.com
instagram.com
whatsapp.com
linkedin.com
chase.com
paypal.com
apple.com
icloud.com
microsoft.com
outlook.com
zoom.us
slack.com
notion.so
nytimes.com
espn.com
stackoverflow.com
python.org
figma.com
airbnb.com
uber.com
venmo.com
twitch.tv
discord.com
x.com
openai.com

The history here is made up for the demo. PhishGuard reads your real one, and it never leaves your machine.

Why not just use blacklists

Blacklists, URL heuristics, and server-side scanners share three problems. They can’t catch a domain registered five minutes ago, they usually need to send your browsing somewhere, and they treat everyone the same even though everyone’s internet looks different. Using your own history avoids all three.

Heads up: the chart below is a qualitative analysis, which is the academic way of saying vibes. It’s my honest read of the trade-offs, not a benchmark.

Qualitative comparison of phishing detection methods — History-based detection compared with the traditional approaches. Most of its advantages are in privacy, personalization, and catching brand-new domains.

Does it actually work

I tested it against anonymized browsing data from 844 real users.

History only: 100% recall
History plus a popular-domain whitelist: 97.74% recall, better precision
Users in the dataset: 844

Using history alone caught every phishing domain, which makes sense, since a phishing domain is almost by definition one you’ve never been to. The harder problem is not flagging every legitimate new site you visit. That’s what the whitelist of popular domains is for, and it costs a bit of recall.

PhishGuard

To test the idea outside a spreadsheet, I built it as a browser extension. It scores how familiar each domain is based on your own history, and flags first visits to domains that look like services you actually use. You can turn on extra checks on top (URL analysis, form security, page content), but the core runs locally and nothing leaves your machine.

Because the signal already lives in your browser, there’s nothing to upload, and no third party learns where you go. A domain registered five minutes ago is new to you, so it gets flagged without waiting for a list to catch up. And as your habits change, what counts as normal changes with them, with nothing to retrain.

The main limitation: I ran out of runway on IRB approval, so there’s no user study behind this. Everything above is tested on historical data, not on real people running into real phishing. That’s the next thing it needs.

There’s also a tension I didn’t fully resolve. Adding a global whitelist improves the numbers but weakens the personalization argument, and defaulting to a million whitelisted domains is probably too many. Figuring out the right size for that list is where I’d start if I picked this back up.