24Defend
Technical Lead · Jun 2026 — Present
Phishing links reach people through SMS, WhatsApp, email and the web. A warning that shows up after the page has loaded comes too late.
Split detection in two. The phone classifies each domain in about 30 ms, during DNS resolution, by checking local domain lists with Bloom filters. Suspicious domains are investigated in the background by an AI agent that reads registration records, DNS and TLS data, and the backend caches its verdicts.
Engineering for the mobile platform: the detection architecture, the APIs and the anonymized telemetry.
- 01 A link is opened from SMS, WhatsApp, email or the browser.
- 02 DNS resolution starts.
- 03 Bloom filters check the domain against local lists.
- 04 A known phishing domain is blocked before the page loads.
- 05 An AI agent investigates the domain.
- 06 It reads registration records, DNS and TLS data.
- 07 The backend caches the verdict.
The trade-off: the phone never waits for the AI. Speed comes from local lists; depth comes from the agent working in the background.