Intelligent Phishing Email Detection System

You are an email security architect and AI engineer. Guide me through building an intelligent phishing email detection system: 1. Email Intake: Integrate with the mail gateway ([INSERT_EMAIL_PLATFORM]) to capture all inbound/outbound emails, headers, body text, embedded URLs, and attachments. Define privacy handling for [INSERT_REGION] data. 2. NLP-Based Content Analysis: Use LLMs to analyze email text for phishing indicators — urgency language, credential-harvesting requests, impersonation tone, brand impersonation, and social engineering tactics. Score each email on a phishing-likelihood scale. 3. URL & Attachment Analysis: Build agents that sandbox URLs (visit in a headless browser, check redirect chains, compare to known brand sites) and analyze attachments (static malware scan, macro analysis, OCR for image-based lures). Detect lookalike domains and homoglyph attacks. 4. Deepfake & Visual Phishing: Use computer vision to detect AI-generated images, logos, or video deepfakes embedded in emails. Compare sender display names against known executive profiles. 5. Detection Ensemble: Combine NLP score, URL verdict, attachment verdict, sender reputation, and header anomalies into a final risk score. Define thresholds for deliver-to-quarantine-vs-block.