<![CDATA[Phishing URLs can imitate legitimate services and expose users to credential theft. This study compared lexical and structural characteristics of phishing and legitimate URLs using the public PhiUSIIL dataset, which documents 100,945 phishing and 134,850 legitimate URLs. URL strings were parsed offline without visiting their destinations. Eight features were examined: URL length, hostname length, digit proportion, hyphen count, hostname dot count, IP-based hosts, HTTPS scheme, and query presence. After removing 425 duplicate records, 235,370 URLs were analyzed using medians, interquartile ranges, proportions, Mann–Whitney tests, rank-biserial effect sizes, and Holm correction. Phishing URLs showed larger digit proportion (r = 0.45), URL length (r = 0.44), hyphen count (r = 0.30), and host length (r = 0.25), whereas hostname dot count differed negligibly (r = −0.03). HTTPS appeared in 48.6% of phishing URLs versus 100% of legitimate URLs; IP-based hosts and query strings occurred only among phishing URLs. Because all legitimate URLs were HTTPS homepage addresses without paths or queries, these contrasts partly reflect how the classes were built. The features are candidate warning indicators, not deterministic rules.]]>
Copyrights © 2026
