Phishing URL Classification Using Lexical Analysis and Machine Learning with an AI-Based Detection Stage

Abstract

Phishing links imitate trusted brands and push users to hand over passwords, card numbers, or other private data. This paper proposes a lightweight, explainable pipeline that decides whether a URL is phishing or legitimate by reading only the address text, with no visit to the destination page. Measurable properties of the string, such as its length, digit and symbol counts, subdomain depth, suspicious keywords, raw-IP usage, and protocol, are turned into a numeric vector for a supervised classifier. Beyond the lexical stage, the paper adds an AI-based detection stage in which a character-level deep-learning model re-examines URLs that the first stage scores with low confidence, and the two scores are fused into a final allow, warn, or block decision. The work is a methodology and literature study: it contains no new experimental accuracy figures, and every number quoted from earlier work is labelled as such. Particular attention is given to duplicate removal, leakage prevention, time-aware testing, and a metric set that includes recall and false-negative rate. Four figures and six tables summarise the pipeline, the feature set, the candidate models, the evaluation protocol, and the limitations.