Project 3 · Cybersecurity Build

Phishing Simulation & Threat Intelligence Dashboard

Educational tools that safely simulate phishing for training, detect suspicious messages with a rules-based (or ML) engine, and surface current threat information in one dashboard. This page includes the build plan plus three live, safe demos: a spot-the-phish quiz, a detection engine, and a threat-intel dashboard.

Demo 1 — Spot-the-phish quiz

One of the awareness modules from the project. Read each email and decide: is it phishing or legitimate? You'll get instant feedback explaining the tell-tale signs. All emails are fictional and safe — no real links.

Question 1 of 5 Score: 0

Demo 2 — Rules-based detection engine

Paste (or edit) an email below and the engine scores it using the same kind of heuristics your backend would run: suspicious keywords, urgency, mismatched links, and requests for credentials. This is the "how the machine decides" companion to the human quiz.

Verdict

Paste an email and press Analyse.

Risk score: 0/100

Version 2: swap these rules for a trained classifier (e.g. Naive Bayes or Logistic Regression on labelled phishing corpora like the Enron/Nazario datasets) to catch subtler messages. The rules engine is your explainable baseline.

Demo 3 — Threat intelligence dashboard

A mock of the dashboard that aggregates public threat feeds. In the real build these panels are populated from live sources (see the note below); here they use representative sample data so the layout and interactions are clear.

37
Active phishing campaigns
12
New CVEs (7 days)
1,284
Malicious IPs blocked
Elevated
Overall threat level

Most-impersonated brands in phishing

Attackers impersonate trusted brands to steal logins. Recognising these is a core awareness lesson.

Where the real data comes from: feeds such as CISA Known Exploited Vulnerabilities, the NVD CVE API, PhishTank / OpenPhish, abuse.ch (URLhaus, ThreatFox), and AlienVault OTX. Your backend fetches these on a schedule, normalises them, caches to a database, and serves them to this dashboard.

Overview

Phishing is the entry point for most breaches, so the best defence is trained people plus good detection. This project builds both: a safe simulator and awareness modules that teach users to spot attacks, and a detection engine + dashboard that show how defenders track threats.

The simulator runs only in a controlled lab or classroom against willing participants who know it's a drill — never as a real deceptive campaign.

Key features

  • Controlled phishing-email simulator for training (lab/classroom only).
  • Rules-based or ML detection engine (demo above).
  • Dashboard aggregating public threat-intelligence feeds.
  • Interactive awareness modules and quizzes for students.

Build plan — step by step

1
Get consent & scope. Decide the audience (a class/club that has agreed to participate). Write a one-page rules-of-engagement: who, what, and that it's a training exercise.
2
Build the awareness site. The quizzes and modules (like the demos here) — pure front-end, hostable anywhere. Start here; it's the safest, highest-value piece.
3
Build the detection engine. Python service that scores email text with clear heuristics; expose it via a small Flask/FastAPI endpoint the dashboard calls.
4
Wire up threat feeds. A scheduled job pulls CISA KEV / NVD / PhishTank / abuse.ch, normalises the data, and stores it. The dashboard reads from your cache (be kind to the APIs).
5
Add the simulator (lab only). A local mail server (e.g. MailHog) delivers the training emails to lab inboxes. A tracking pixel/link records who clicked — then immediately shows a "this was a drill" teaching page. Never send to anyone who hasn't opted in.
6
Measure & teach. Report click-through rates (anonymised/aggregated), then deliver the awareness modules. Show improvement after training.
7
Document privacy handling. Explain what data you collected, how it's aggregated, and how it's deleted. Privacy is a graded learning outcome here.

Ethics & safety — read this first

  • Consent is mandatory. Only simulate phishing against people who have agreed to be part of a training exercise.
  • Lab only. Keep the mail server and links inside a private environment; never send simulated phishing over the open internet to real strangers.
  • Teach, don't trick. Every simulated click leads straight to an educational page — the point is learning, never embarrassment.
  • Protect privacy. Aggregate results, don't single people out, and delete personal data when done.
  • Read-only threat feeds. You consume public intel; you never attack the sources.

Learning outcomes

Social-engineering defence
Recognising manipulation tactics
Data analysis
Scoring, feeds, click metrics
Privacy
Consent, aggregation, minimisation
User education
Designing effective training