Phishing Detection

How Phishing Detection Works

Phishing detection operates at multiple layers, each catching different types of attacks at different stages:

URL and Domain Analysis

The first line of detection examines the URL itself for phishing indicators:

• Lexical analysis — Examining URL structure for suspicious patterns: brand names combined with random strings, excessive subdomains, use of IP addresses instead of domain names, unusual TLDs
• Domain age and registration data — Newly registered domains are statistically more likely to be malicious. WHOIS/RDAP data can reveal suspicious registration patterns
• Homograph detection — Identifying URLs that use Unicode characters to mimic legitimate domains (e.g., using Cyrillic characters that visually resemble Latin letters)
• Typosquatting detection — Comparing URLs against known brand domains using string similarity algorithms (Levenshtein distance, Jaro-Winkler similarity)

Content and Visual Analysis

Examining what the page actually contains:

• Visual similarity comparison — Comparing the page's visual appearance against known legitimate sites using image comparison, screenshot analysis, and layout fingerprinting
• HTML/CSS analysis — Detecting copied source code, stolen logos and images, cloned form structures
• Form analysis — Identifying credential-harvesting forms (login pages, payment forms) that submit data to external servers
• Brand asset detection — Finding unauthorized use of logos, favicons, color schemes, and other brand identifiers

Machine Learning Approaches

Modern phishing detection increasingly relies on ML models:

Feature-based classification — Models trained on URL features (length, number of special characters, subdomain depth, TLD type) and page features (number of external links, presence of forms, iframe usage). Random Forest and XGBoost classifiers have demonstrated accuracy rates of 98-99% in published research.

Deep learning — Neural networks that process raw URL strings or page content without manual feature engineering. Transformer-based models (including BERT variants) capture contextual patterns in URLs and content that traditional feature extraction misses.

Large Language Model embeddings — Emerging research (2025) uses LLMs to generate URL embeddings that capture complex patterns and token relationships, enabling detection of novel phishing patterns without manual feature engineering.

Threat Intelligence

Cross-referencing against known threat data:

• Blocklists — Google Safe Browsing, PhishTank, OpenPhish, and similar databases of confirmed phishing URLs
• IP reputation — Checking hosting IP addresses against known malicious infrastructure
• Certificate analysis — Flagging domains using free DV certificates from certain providers (common for phishing sites) versus OV/EV certificates (more common for legitimate businesses)
• Infrastructure correlation — Identifying domains that share hosting, nameservers, or registrar patterns with confirmed phishing campaigns

Detection Contexts

Phishing detection applies in three primary contexts:

1. Email Gateway Detection

Email security solutions scan inbound messages for phishing indicators before delivery. This includes URL analysis, sender reputation checking, attachment scanning, and content analysis. Products like Microsoft Defender for Office 365, Proofpoint, and Mimecast operate at this layer.

2. Browser-Based Detection

Browsers check URLs against safe browsing databases in real time. Google Chrome uses the Safe Browsing API, Microsoft Edge uses SmartScreen, and Firefox uses Google Safe Browsing data. These provide user-facing warnings when a known phishing site is accessed.

Research has also explored browser extensions that use machine learning for real-time phishing URL detection, providing an additional layer beyond static blocklists.

3. Brand-Side Detection

Rather than protecting individual users or inboxes, brand-side detection finds phishing sites that impersonate a specific brand — regardless of how victims are directed there. This approach:

• Monitors domain registrations and Certificate Transparency logs for brand-resembling domains
• Crawls detected domains for content that copies the brand's visual identity
• Analyzes infrastructure signals (hosting, DNS, certificates) to prioritize likely threats
• Connects detection to enforcement (takedown) rather than filtering

This is the domain of brand protection platforms. The advantage is that removing the phishing site at its source protects all potential victims, rather than filtering attacks one inbox at a time.

The Detection-to-Takedown Pipeline

Detection is only valuable if it leads to action. The pipeline:

1. Signal — A new domain, certificate, or web page triggers a detection rule
2. Enrichment — Additional data is gathered: WHOIS records, DNS configuration, page content, visual similarity score
3. Classification — The signal is classified as likely phishing, suspicious, or benign
4. Prioritization — High-confidence detections are prioritized for immediate action
5. Verification — Human review confirms the classification (or automated systems apply high-confidence thresholds)
6. Enforcement — Takedown requests are filed with registrars, hosting providers, and safe browsing list operators
7. Monitoring — The enforcement action is tracked until the phishing site is confirmed offline

The speed of this pipeline is the critical metric. Every hour a phishing site remains active exposes more potential victims. The best systems complete this pipeline in minutes, not days.

Challenges in Phishing Detection

Evasion techniques — Attackers use cloaking (showing different content to crawlers vs. real users), geographic targeting (only serving phishing content to specific regions), and time-delayed activation (registering domains days before deploying malicious content).

Scale — With 800,000+ phishing attacks per quarter (APWG data), and new domains registered at a rate of roughly 60 per second, detection systems must process enormous volumes of data in real time.

False positives — Overly aggressive detection can flag legitimate sites (new businesses, marketing campaigns) as phishing. Balancing sensitivity (catching real phishing) with specificity (avoiding false alarms) is an ongoing challenge.

Short-lived attacks — Many phishing sites are active for only hours before rotating to a new domain. Detection that takes days is detection that arrives after the damage is done.