Uniform Resource Locator Classifier and Visual Comparison Platform for Malicious Site Detection

A method, comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• comparing a computer vision vector representation of image data to a plurality of stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element;
• generating, by inputting the feature into a classifier, a phish classification score indicating a likelihood that the URL is malicious;
• in response to determining that the phish classification score exceeds a first phish classification threshold, causing a cybersecurity server to perform a first action;
• and
• in response to determining that the phish classification score exceeds a second phish classification threshold, causing the cybersecurity server to perform a second action different from the first action, wherein:
• causing the cybersecurity server to perform the first action comprises setting a first flag, and
• causing the cybersecurity server to perform the second action comprises setting a second flag, wherein the first flag and the second flag are set in a cybersecurity database accessible by the cybersecurity server.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• compare a computer vision vector representation of image data to a plurality of stored numeric vectors representing page elements, resulting in a feature indicating whether the computer vision vector representation of the image data is visually similar to a known page element;
• generate, by inputting the feature into a classifier, a phish classification score indicating a likelihood that the URL is malicious;
• in response to determining that the phish classification score exceeds a first phish classification threshold, cause a cybersecurity server to perform a first action;
• and
• in response to determining that the phish classification score exceeds a second phish classification threshold, cause the cybersecurity server to perform a second action different from the first action, wherein:
• causing the cybersecurity server to perform the first action comprises setting a first flag, and
• causing the cybersecurity server to perform the second action comprises setting a second flag, wherein the first flag and the second flag are set in a cybersecurity database accessible by the cybersecurity server.