Phishing Website Detection Using URL Features

Abstract

Phishing attacks have become one of the most pervasive cyber-security threats, with attackers using fraudulent websites to deceive users and steal sensitive information. Conventional detection methods often rely on blacklists and content-based analysis, which are computationally expensive and struggle with zero-day attacks. This study proposes a lightweight, real-time phishing detection system that utilizes only URL-based features combined with machine learning classifiers. A dataset of phishing and legitimate URLs was collected and pre-processed.  The   extracted structural URL features including token length, digit count, symbol frequency, domain age, use of IP address, and lexical properties. Multiple classifiers Random Forest, Support Vector Machine (SVM), Gradient Boosting, and XGBoost were trained and evaluated. The  XGBoost model achieved the highest performance with 98.7% accuracy, 98.4% precision, 98.9% recall, and 98.6% F1-score on the test set, outperforming baseline methods. Feature importance analysis revealed that domain length, presence of hyphens, and abnormal token counts strongly correlate with phishing behavior. The proposed model is suitable for integration into browsers and email security systems for early URL filtering.