<![CDATA[Phishing URLs continue to evade classical filtering approaches as attackers refine their obfuscation strategies, motivating machine learning-based detection methods that adapt more readily to new patterns. This work compares three classifiers, Random Forest, Extreme Gradient Boosting (XGBoost), and a hybrid CNN-LSTM model, for phishing URL classification using enhanced lexical feature engineering, syntax-aware preprocessing, and systematic component-wise ablation analysis. First, the conventional six-feature lexical representation is extended to fourteen handcrafted features by incorporating cues associated with modern phishing behavior, including suspicious keywords, top-level domain characteristics, hexadecimal encoding, and query-parameter statistics. Second, a syntax-aware preprocessing strategy selectively removes non-structural punctuation while retaining structural URL delimiters. Third, cross-source duplicate URLs are resolved through a two-stage majority-vote deduplication process to reduce redundancy and potential data leakage. Fourth, all classifiers are evaluated under a shared data preparation protocol while retaining model-specific feature representations and configurations. Experiments on the Kaggle Malicious URLs dataset achieved accuracies of 95.47%, 97.86%, and 98.59% for Random Forest, XGBoost, and CNN-LSTM, respectively, with corresponding F1-scores of 92.97%, 96.73%, and 97.89%. CNN-LSTM achieved the highest overall test-set performance with 98.59% accuracy and 99.85% ROC-AUC, while XGBoost provided the strongest performance among the tree-based models. The results indicate that combining syntax-aware preprocessing and expanded lexical features with model-specific representations provides an effective framework for phishing URL classification.]]>
