ThreatLens: A Dual-Vector Telemetry Gateway for Real-Time Ephemeral Phishing and Smishing Mitigation

Phishing and smishing campaigns increasingly use short-lived infrastructure that can evade static reputation feeds and domain blacklists. This work presents ThreatLens, a dual-vector zero-trust gateway that combines transport-layer host interrogation with lexical and information-theoretic analysis. The architecture performs DNS resolution, TLS handshake and certificate-related probing, while a 20-dimensional feature representation captures lexical structure, entropy and morphological characteristics. An empirical evaluation was conducted on 5,000 verified samples comprising 2,500 benign domains and 2,500 malicious endpoints, using stratified 10-fold cross-validation. Among the evaluated classifiers, the proposed Random Forest configuration achieved 98.40% accuracy, 98.20% precision, 98.60% recall, a macro F1-score of 0.9840 and ROC-AUC of 0.9961. The reported model-inference latency was 0.11 ms/request, while the reported end-to-end gateway latency remained below 34 ms. ThreatLens also incorporates asynchronous browser telemetry and cloud-based audit logging to support real-time monitoring and forensic traceability. The results indicate that combining lexical, information-theoretic and transport-level signals can provide a practical basis for real-time phishing and smishing mitigation.