Year: 2026
Type: article
Abstract: Phishing links reach users faster than blacklists can list them, so a browser needs an early signal of its own. This paper evaluates a lightweight, URL-only detector and a Chrome extension prototype that runs it locally. We extract 31 lexical and structural features from each URL and compare Logistic Regression, a Decision Tree and a Random Forest on 411,178 deduplicated URLs (66,379 malicious), using both a random split and a domain-disjoint split in which no registered domain appears in both training and test data. On the domain-disjoint test set the Random Forest reached an F1-score of 0.757 and an ROC AUC of 0.956, ahead of the Decision Tree (0.692) and Logistic Regression (0.538); a random split overstated its F1-score at 0.815. With a threshold chosen on validation data to limit false alarms, the Random Forest reached 95.4% precision and 51.3% recall at a 0.5% false-positive rate. On 20,000 URLs from a 2026 phishing feed, recall at the default threshold was 82.8% but fell to 31.9% at the conservative threshold and 11.5% of a list of mainstream websites was flagged at the default threshold, which shows sensitivity to data drift. A compact 30-tree forest (1.2 MB) scored a URL in about 0.02 ms in Node.js with predictions matching the Python model. URL-only screening is therefore useful as a fast first layer, not as a standalone defense.
Author: Akhil Thakur
Language: English
Topic: Spam and Phishing Detection
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7225529025