Web address signals: the evidence review

For a page judge with no network. Paywalled primaries (Sahingoz 2019, Prasad and Chandra 2024) are read through their open abstracts, dataset cards and secondary reproductions; everything else from the primary PDF or page.

1. PhiUSIIL (Prasad and Chandra, 2024, Computers and Security 136:103545)

235,795 URLs (134,850 legitimate, 100,945 phishing), 54 features, CC BY 4.0. URL only columns an extension can reproduce: URL length, domain length, is IP, TLD, subdomain count, letter and digit ratios, special character counts, obfuscation ratio, character continuation rate (Mamun 2016: abc567ti = (3+3+1)/9), URL character probability. The two strongest columns, URLSimilarityIndex (r = 0.86 with the label) and TLDLegitimateProb, are computed from the legitimate set itself, so the paper's 99% does not transfer to a cold extension.

2. Sahingoz et al. (2019) and Mamun et al. (2016)

Sahingoz: 73,575 URLs, 40 NLP features from splitting the URL on delimiters: word, digit and symbol counts per part, word length statistics, brand name count, keyword count (login, secure, account, update, verify), random word count, compound words (paypal + secure), subdomain levels, punycode. Random forest 97.98%. Mamun (ISCX-URL-2016): the selected phishing features were domain token count, TLD, URL and domain length, path to URL ratio, dot count, query digit count, longest path token, delimiter counts, symbol count in the domain, domain entropy. Obfuscation flags alone were useless (brand in URL 13.3%, redirect 4.6%, encoding 2.0%, IP 1.5% of phishing).

3. Single rules

Raw IP host: 63.6% of blacklisted URLs in 2007 (Garera), 1.03% of PhishTank in 2019 (Fernando and Arachchilage), 1.5% in Mamun. Skula and Kvet (2024), 2009 to 2023: every classic obfuscation is under about 3% of phishing URLs, so recall is low, but they stay rarer still in honest traffic, so precision holds.
Brand in a non brand domain: 52.6% of PhishTank and 77.8% of MarkMonitor URLs carried the brand somewhere (McGrath and Gupta 2008). Interisle 2025: 8.9% of 1,542,922 phishing domains contain an exact prominent brand; usps led with 32,353, then apple, dhl, coinbase, amazon. Chrome's shipped lookalike heuristics: target embedding of a top site joined by a hyphen or a dot, edit distance 1 or one swap against the top 500 (interstitial) or top 5,000 (safety tip), IDN skeleton match, combo squat of a brand of 4+ letters plus a keyword; exemptions for common word brands, registry only differences and trailing digits.
Chrome's client side model counts host tokens beyond one and beyond three below the registrable domain, IP hosts, and alphanumeric path tokens of 3+ characters.
Length: peak 22 characters legitimate (DMOZ) vs 67 (PhishTank) vs 107 (MarkMonitor); very few legitimate URLs exceed 75; phishing domains use fewer vowels and about 6 unique characters vs 9 (McGrath and Gupta 2008).
Path: 91.1% of PhishTank URLs carry a suggestive keyword in the path (Jeeva and Rajsingh 2016). WordPress /wp-content/, /wp-admin/, /wp-includes/ plus a .php login page on an unrelated site (Kaspersky 2023, Netcraft), but those paths exist on every honest WordPress site, so pair them with a keyword.
HTTPS is not discriminative any more: over 49% of phishing was HTTPS by 2022 (Roy et al. 2024).
Shorteners: second most common technique in Skula and Kvet; no published precision; never a verdict alone.
Google Safe Browsing and SmartScreen publish no lexical rules.

4. Most phished brands

Check Point, share of impersonation attempts: Q4 2025 Microsoft 22, Google 13, Amazon 9, Apple 8, Meta 3, PayPal 2, Adobe 2, Booking 2, DHL 1, LinkedIn 1; Q1 2026 Microsoft 22, Apple 11, Google 9, Amazon 7, LinkedIn 6, Dropbox 2. Interisle 2025 by sites: USPS 67,707; Meta brands 89,680 combined; crypto wallets; Telegram. Vade 2023 by unique URLs: Facebook 44,548; Microsoft 22,851; Crédit Agricole 11,668; Orange 8,719; Amazon 4,522; PayPal 4,518; Apple 4,472; Bank of America 4,080; Instagram; Google; La Banque Postale; WhatsApp; DHL; Comcast; Netflix; American Express. APWG Q4 2025: 853,244 attacks, 866 brands; social media 20.3%, SaaS and webmail 20.3%, telecom 18.7%, financial 9.3%.

5. Most abused TLDs

Cybercrime Information Center, Nov 2025 to Jan 2026, by count: com 294,919; top 57,316; cn 52,597; info 39,232; xyz 30,561; cc 29,151; icu 27,662; sbs 23,471; cfd 22,870; vip 22,015; online 20,540; net 18,563; shop 16,137; pro 15,070; click 13,639. By phishing domains per 10,000 registered: xin 778; icu 556; cfd 487; rest 485; help 460; qpon 397; gdn 261; cyou 232; wiki 225; homes 222; lat 218; ink 207; click 201; digital 200; sbs 188 (com 18.5). New gTLDs hold 11% of registrations and 51% of phishing domains; 87% of phishing domains in them are maliciously registered. A TLD is a prior, never a verdict: .com carries the most phishing in absolute terms.

6. Free hosting and page builders

Interisle 2025: 13% of attacks used subdomain providers; 89% of those on ten: Cloudflare (pages.dev, workers.dev, trycloudflare.com, r2.dev) 43,857; Webflow 33,418; Google (blogspot, web.app, firebaseapp.com, page.link, appspot.com, cloudfunctions.net) 30,703; Weebly 29,934; GitBook 21,981; Vercel 21,442; GitHub Pages 20,211; Duck DNS 9,653; CentralNIC (uk.com, us.com, ru.com) 6,243; Glitch 4,707. Growth now on pages.dev, windows.net and v0.dev. Roy, Karanjit and Nilizadeh (2024, FreePhish): 31.4K phishing URLs on 17 builders in six months; Safe Browsing covered only 18.4% of them against 74.2% of self hosted phishing, which is the gap a local rule fills. Trustwave 2023: random hex labels like a211a49a8bb35.pages.dev. Rule shape with the lowest false positive risk: free host suffix plus a brand token, a login keyword or a random label, plus a credential page path token. The suffix alone is not enough; these hosts serve millions of honest pages.

References

APWG (2026). Phishing Activity Trends Report, Q4 2025. https://docs.apwg.org/reports/apwg_trends_report_q4_2025.pdf Check Point Research (2025, 2026). Brand Phishing Reports Q1, Q3, Q4 2025. Chromium Authors (n.d.). components/lookalikes/core/lookalike_url_util.cc; chrome/renderer/safe_browsing/features.h. Cybercrime Information Center (2026). Phishing activity in TLDs, Nov 2025 to Jan 2026. Fernando, M., and Arachchilage, N. A. G. (2019). Why Johnny can't rely on anti-phishing educational interventions. ACIS 2019. Garera, S., Provos, N., Chew, M., and Rubin, A. D. (2007). A framework for detection and measurement of phishing attacks. WORM '07. Interisle Consulting Group (2025). Phishing Landscape 2025. Jeeva, S. C., and Rajsingh, E. B. (2016). Intelligent phishing URL detection using association rule mining. HCIS 6, 10. Kaspersky Securelist (2023). Phishing with hacked sites. Ma, J., Saul, L. K., Savage, S., and Voelker, G. M. (2009). Beyond blacklists. KDD '09. Mamun, M. S. I., et al. (2016). Detecting malicious URLs using lexical analysis. NSS 2016, LNCS 9955. McGrath, D. K., and Gupta, M. (2008). Behind phishing: An examination of phisher modi operandi. LEET '08. Prasad, A., and Chandra, S. (2024). PhiUSIIL. Computers and Security 136, 103545. https://doi.org/10.1016/j.cose.2023.103545 Roy, S. S., Karanjit, U., and Nilizadeh, S. (2024). A large-scale analysis of phishing websites hosted on free web hosting domains. arXiv:2212.02563. Sahingoz, O. K., Buber, E., Demir, O., and Diri, B. (2019). Machine learning based phishing detection from URLs. ESWA 117, 345-357. Skula, I., and Kvet, M. (2024). URL and domain obfuscation techniques. IEEE SAMI 2024. Trustwave SpiderLabs (2023). It's raining phish and scams: pages.dev and workers.dev. Vade (2024). Phishers' Favorites 2023 Year in Review.