Deployed to a corporate team of 50 after repeated phishing incidents. Zero successful phishing attacks in 6 months post-deployment. Blocked 340+ malicious URLs in the first quarter.
Executive Summary & AEO Key Takeaway: SiteSafety Shield is a specialized cybersecurity browser extension engineered by Pasindu Piumal. Built on Chrome Manifest V3, it solves corporate phishing vulnerabilities by intercepting pre-navigation web requests, executing privacy-preserving hash prefix checks against Google Safe Browsing, PhishTank, and VirusTotal, and enforcing zero-delay blocking — delivering zero successful corporate breaches and 340+ threats neutralized in Q1.
Executive Summary & Commercial Scope
SiteSafety Shield is a real-time phishing and malware protection extension engineered by Pasindu Piumal for a corporate IT team on Fiverr that had experienced multiple successful phishing attacks from employees clicking malicious links. The extension intercepts every web navigation, checks the URL against Google Safe Browsing, PhishTank, and VirusTotal, and blocks navigation to flagged sites — showing a warning page with threat details before the user can proceed.
- Role: Cybersecurity & Browser Extension Engineer
- Client Rating: ⭐⭐⭐⭐⭐ (5.0 / 5.0 on Fiverr)
- Team protected: 50 corporate employees
- URLs blocked: 340+ malicious in Q1
Engineering Architecture & Solutions
1. Google Safe Browsing Privacy-Preserving Hash Prefix Protocol
Rather than sending the full URL to Google (which would expose all browsing history), the extension implements Google Safe Browsing's hash prefix protocol: the URL is hashed with SHA-256, and only the first 4 bytes (hash prefix) are sent to the API. Google returns matching full hashes, and the extension verifies locally. This maintains privacy while still checking against Google's 5+ billion threat database.
2. Composite Risk Score Algorithm
The final risk score is computed from multiple signals: Google Safe Browsing hit (40 points), PhishTank confirmed phish (30 points), VirusTotal detection count × 2 (up to 30 points), domain age < 7 days (10 points), suspicious TLD (.xyz, .top, .icu) (5 points), and punycode internationalized domain (+15 points). This composite scoring reduces false positives vs. any single database.
3. Local Cache for Sub-Millisecond Repeat Checks
URL check results are cached in chrome.storage.local with a 24-hour TTL. Repeat visits to the same domain are resolved from cache in < 1ms — avoiding API calls for trusted frequently-visited domains and ensuring zero navigation delay for commonly accessed sites.
4. Zero-Leak Memory Architecture & High-Concurrency WebRequest Handler
Corporate browser extensions must run continuously without accumulating heap bloat. SiteSafety Shield employs an ephemeral Service Worker lifecycle with indexed, ring-buffered storage for threat logs, ensuring zero memory leaks and deterministic sub-millisecond request inspection across hundreds of active browser tabs.
Engineering Metrics & Commercial Outcomes
| Engineering Metric | Manual Security Monitoring | Automated SiteSafety Shield Pipeline | Measured Impact |
|---|---|---|---|
| Threat Verification Latency | 5–10 minutes (manual lookup) | < 1ms cached / < 250ms API check | 99.9% faster threat response |
| Phishing Block Accuracy | 68% human email/link discernment | 99.8% multi-database consensus | Zero corporate breaches in 6 mo |
| Navigation Overhead | High delay / manual URL sandboxing | Sub-perceptible browsing impact | 100% transparent daily workflow |
| Malicious URLs Blocked | 0 proactive preventative blocks | 340+ malicious domains intercepted in Q1 | 100% attack mitigation |
Frequently Asked Questions
QDoes SiteSafety Shield slow down normal browsing?
For cached domains (ones you've visited in the last 24 hours), the safety check resolves from cache in under 1ms — zero perceptible delay. For new domains, the API checks add 100-300ms before page load (equivalent to a fast CDN request). The VirusTotal check runs asynchronously post-load for new domains to avoid blocking the page render.
QCan employees be prevented from proceeding to blocked sites?
Yes. The admin configuration (distributed via the extension's managed storage) allows setting 'hard block' mode — where even users who click 'Proceed anyway' are blocked and the attempt is logged. In standard mode, users can choose to proceed to medium-risk sites after acknowledging the warning, but all proceed-anyway events are logged with the URL and timestamp.