URL and domain characteristics
The web address, domain context and available information about redirects.
Argus — AI for phishing detection.
Argus is AI technology developed by Anti Phishing Technologies to automate the analysis and classification of phishing threats.
The system uses machine learning and multiple layers of signal analysis to assess suspicious websites, including those that conventional reputation systems have not yet identified.
Our research focuses on improving detection, reducing errors and developing the system’s ability to recognize new methods of online fraud.
Recognizing threats before they are reported.
Traditional blocklists identify threats that have already been reported. Argus extends the analysis to the characteristics of a suspicious website, so its assessment does not depend solely on the site’s existing reputation.
Multiple signals. One risk assessment.
The system uses available information about the URL, page structure and content, together with the context provided by threat data. The results are combined in a classification process designed to identify characteristic signs of phishing.
Page structure and content
Text, forms and page elements that may indicate an attempt to steal sensitive information.
Threat data and context
Information about known threats and the address’s reputation, considered alongside the page analysis.
Layered classification
Combining analysis results with other signals as part of the risk assessment process.
The evidence available depends on the analysis path and how much of the page can be read.
An architecture built for classification.
Argus V6 has a Transformer-based text encoder at its core. It converts prepared representations of the URL and page content into vectors that can be combined with numerical features of the website. A separate branch processes those features, and a classification head combines both kinds of information to produce the model’s score.
This is a classification architecture, not a generative language model that holds a conversation. Its output is one part of a wider process that includes input preparation, checks on the quality of the captured page and other detection layers.
APT develops the analytical architecture, adapts components for phishing detection and integrates them into a protection system.
AI advanced through research.
Detection models require ongoing evaluation and improvement. We develop the Argus architecture, test new approaches and examine misclassifications to improve the system’s accuracy and reliability.
This work covers training data quality, recognition of new attack variants and the reduction of false alarms. Model changes are prepared and evaluated through our research process.
Toward increasingly autonomous protection.
Our long-term goal is technology that can assess threats on its own with a high degree of reliability, including when phishing is difficult for a person to recognize. We work to reduce errors and handle cases where the available evidence does not support a clear classification.
We believe effective protection requires both knowledge of existing attacks and the ability to analyze new ones. Greater autonomy remains a direction for our research.
The technology in practice
Anti Phishing Security for Windows provides access to the full Argus analysis path. The sensor works with the Anti Phishing Sensor extension in Chrome or Edge and, in selected cases, sends captured page content for deeper analysis. Android follows a separate, local path: it blocks domains in the confirmed threat database.