Jul 2026· International Journal for Research in Applied Science and Engineering Technology· Vol 14, pp. 1772-1785· 0 citations
TL;DR
RakshNet–PhishGuard is proposed, a client-first, multi-layer URL threat detection system that classifies a submitted URL as Safe, Suspicious, or Phishing without depending on a live threat-intelligence database.
Abstract
Phishing remains one of the most prevalent and financially damaging cyberattack vectors, with attackers routinely
disguising malicious links through typosquatting, homograph substitution, brand impersonation, and abuse of free top-level
domains. Existing defenses are largely reactive — blocklist services cannot flag a newly registered phishing domain until it has
already been reported, while enterprise secure-web gateways are priced for organizations rather than individual users. In this
paper, we propose RakshNet–PhishGuard, a client-first, multi-layer URL threat detection system that classifies a submitted URL
as Safe, Suspicious, or Phishing without depending on a live threat-intelligence database. Twenty-five lexical and structural
features are extracted from each URL and evaluated by two cooperating layers: a deterministic heuristic engine that checks
twelve categorical red-flag rules, and a machine-learning ensemble of six classifiers — Logistic Regression, Naive Bayes,
Decision Tree, Random Forest, Support Vector Machine, and Gradient Boosted Trees (XGBoost) — trained on a stratified 168-
URL sample drawn from the Hannousse and Yahiouche phishing-URL benchmark. A large-language-model layer (Google
Gemini, invoked through a serverless cloud function) converts the combined verdict into a plain-language explanation for nontechnical users, and a community-reporting module lets users flag suspicious URLs for analyst review. Under 5-fold stratified
cross-validation, Logistic Regression achieved the best overall performance (79.17% accuracy, 0.861 AUC), followed closely by
the Support Vector Machine (76.19% accuracy, 0.859 AUC); a Random Forest feature-importance analysis further shows that
the categorical indicators the heuristic layer specifically targets carry essentially zero learned weight in the trained models,
confirming the two layers cover complementary failure modes. The project's documented test plan, covering single and bulk
scanning, role-based access, and the AI-service fallback path, produced its expected result in all eight scenarios, with heuristic
analysis completing in under 50 ms per URL. This paper additionally positions the system against nine related works spanning
feature-engineered ML, deep representation learning, and large-language-model-assisted detection, and reports the system's
functional, non-functional, and hardware/software requirements in full. The complete system is implemented as a React 18 and
TypeScript single-page application in which every trained model runs entirely client-side, requiring no backend inference server.
A hybrid browser-resident phishing detection framework that combines three complementary detection mechanisms: a locally executed Random Forest model using URL lexical features, lightweight real-time DOM structure analysis, and VirusTotal’s multi-engine reputation service is proposed.
Muhammad Arshad, Beena Sherin Kuriakose, C. W. Onn et al.· Frontiers of Computer Scienc...· 0 citations
Background: Phishing attacks grow more complex - attackers employ social engineering that targets local customs, and they build short-lived systems so that they remain hidden. This paper proposes a method that identifies phishing inside Iraq's corner of the internet. The method merges word patterns, domain records, open source intelligence plus language markers that occur in Iraq.
Materials and Methods: We assembled 18 060 URLs - gathering addresses from local Telegram channels, from worldwide threat feeds and from confirmed safe sites. Statistical inspection revealed strong differences between phishing and safe URLs (p < 0.001). The main differences appeared in URL length, in the count of special characters and in the presence of Iraqi terms. System attributes also differed - phishing links often used young domains, unusual suffixes, as well as servers located outside Iraq. Those attributes signal campaigns that aim at Iraqi users.
Results: A Random Forest model with 200 trees and a maximum depth of 20 was trained on a stratified 70 % train, 30 % test split under 10-fold cross-validation. The model reached 96.84 % accuracy, 97.18 % recall or an ROC-AUC of 0.984. An ablation test showed that the inclusion of Iraq-specific features raised recall by 2.68 % and accuracy by 1.64 %. This confirms that regional language data adds value.
Discussion: A review of feature importance ranked Iraqi keywords next to domain age as the two most informative signals. The outcome indicates that phishing detection improves when models incorporate attributes that match the target region. The benefit is largest in emerging digital markets where attackers combine local social engineering with rapid infrastructure changes.
Jaber M. Al-Dulimi· Journal of Al-Turath Univers...· 0 citations
Efficiency makes the proposed approach exceptionally suitable for real-time detection in resource-constrained environments, such as mobile applications or browser extensions, providing an accessible and proactive layer of defense for end-users.
Phishing remains one of the most persistent cyber threats, particularly in email environments where deceptive messages can be distributed at scale. This paper compares five classifiers: Multinomial Naive Bayes, Random Forest, Bidirectional Long Short-Term Memory (BiLSTM), DistilBERT, and BERT-base. A multi-source corpus of 82,689 cleaned and deduplicated emails was built from nine public datasets. Under a unified protocol, BERT-base achieved the highest F1-score (0.9824), while DistilBERT obtained an almost identical F1-score (0.9822) with lower measured inference latency (1.130 versus 2.218 ms/email), representing the strongest accuracy–latency trade-off in the evaluated environment. LIME explanations exposed plausible phishing indicators, such as urgency and account-verification language, but also mixed local contributions that require cautious interpretation. In the source-held-out experiment, the positive-class prevalence changed from 41.1% in training to 26.6% in testing, and DistilBERT produced 505 false negatives but only two false positives. Consequently, recall decreased from 0.9750 to 0.5346, showing that high mixed-source test performance does not guarantee robustness when complete data sources are unseen.
Andre Sebastian Samaniego Buñay, Ariel Misael Orellana Albarracin, Joel Marcelo Chuquimarca Pomagualli· Enfoque UTE· 0 citations
Phishing remains one of the most persistent cyber threats, and almost every campaign ultimately depends on a deceptive Uniform Resource Locator (URL). Existing defences face a structural trade-off: blacklists are reactive and cannot cover newly registered domains during the zero-hour window, while machine-learning detectors, although accurate, are opaque, feature-hungry, and often depend on page content or full DNS telemetry that many organisations cannot collect. This study proposes and evaluates a lightweight, fully interpretable two-level rule-based framework that fuses lexical URL features with domain registration evidence retrieved through the Registration Data Access Protocol (RDAP). Level 1 scores each URL using five transparent lexical rules derived from training-set distributions of domain length, number of dots, number of hyphens, number of digits, and URL entropy. Level 2 applies three RDAP rules covering domain age, days to expiry, and a missing-registration-data flag, targeting the young, short-lived, and poorly documented domains that characterise phishing infrastructure. The two levels are combined through logical OR and AND decision fusion and evaluated on a balanced, held-out set of 400 URLs drawn from a curated corpus of 800. Level 1 achieved 95.50% accuracy (precision 0.9789, recall 0.9300); Level 2 achieved perfect recall (1.0000) at 0.8969 precision; OR fusion preserved perfect recall; and AND fusion delivered the best overall result at 96.50% accuracy with perfect precision, zero false positives, and a Matthews Correlation Coefficient of 0.9323. A confusion-matrix decomposition further shows that the false-positive sets of the two levels are completely disjoint, confirming that lexical and registration evidence fail independently. Exploiting this, a cascaded implementation of AND fusion reproduces identical decisions while issuing RDAP queries for only 47.5% of URLs, a 52.5% reduction in external lookups.
Wan Afifie Aliff Bin Wan Abdullah, Zulkiflee Muslim, Haniza Nahar et al.· International journal of res...· 0 citations
The rapid growth of digital services in banking, e-commerce, education, and government sectors has significantly increased phishing attacks. Traditional blacklist-based detection systems are ineffective against zero-day phishing domains that imitate legitimate websites. To address this challenge, this paper proposes PHISHGUARD AI, a real-time phishing URL detection framework integrating a hyperparameter-optimized XGBoost classifier with explainable artificial intelligence (XAI) and community-driven threat intelligence. The framework utilizes lexical and structural features from URLs to calculate phishing probability using a tuned XGBoost classifier. Evaluation results on the PhiUSIIL dataset $(\mathbf{N}=\mathbf{2 3 5, 7 9 5})$ achieved 94.0% accuracy, 94.02% precision, 94.00% recall, and 94.01% F1-score. The explainability module improves transparency by identifying influential features responsible for each prediction. Finally, a community-based threat intelligence program enables users to validate and incorporate previously user-reported URLs into their machine learning models through continuous retraining cycles. Evaluation of the experimental data from this framework demonstrated a high detection accuracy with improved generalization for newly emerging phishing attacks. The proposed framework provides scalable and proactive phishing detection with improved interpretability.
B. Kowshik Shrinivas, S. Rajalingam, K. N. M. Muthukaruppan et al.· International Conference on...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
