Phishing URL Detection — Production MLOps

A model nobody can call is not a service

Classifying a URL as phishing or legitimate is a modest modelling problem. Turning that classifier into something with a stable interface, reproducible training, a versioned artefact and a repeatable path to a running server is the actual engineering.

This project is built as the second thing rather than the first: an end-to-end MLOps pipeline where the model is one component among several.

Ingest, validate, transform

The pipeline ingests, validates and transforms phishing-site data as discrete stages rather than one script. Validation sits between ingestion and transformation on purpose — it is the stage that catches a bad upstream change before it silently becomes a bad model.

Five classifiers, one comparison

• Trained and benchmarked five classifiers — Random Forest, Gradient Boosting, AdaBoost and others — on the same prepared data.
• Hyperparameters tuned with GridSearchCV, so the comparison is between tuned models rather than default ones.
• Every run tracked in MLflow via DagsHub, so the selection is auditable after the fact instead of remembered.

A REST endpoint, not a notebook cell

Predictions are served through a FastAPI REST endpoint — a real interface with a schema that other software can call, which is the point at which a model becomes usable by anything other than its author.

Shipped by a pipeline, not by hand

Deployment is automated as a three-stage CI/CD pipeline: GitHub Actions builds the application, pushes a Docker image to AWS ECR, and releases it through a self-hosted EC2 runner.

The same discipline carried directly into professional work — decibyl.ai reached production on an equivalent GitHub Actions → ECR → EC2 release path.

Source

Code on GitHub.