<![CDATA[Phishing URLs distributed through social media may employ structural and character-level obfuscation to make malicious links more difficult to recognize. Although previous studies have extensively investigated phishing URL classification, the distribution of specific URL obfuscation patterns and the changes in token composition associated with canonicalization require further empirical examination in Facebook-related phishing URL datasets. In particular, the relationship between rule-based structural detection and token-set similarity has not been sufficiently established in the context of this study. This research aims to identify structural obfuscation patterns, examine their co-occurrence, and evaluate changes in URL token composition using Jaccard similarity. A total of 1,000 phishing URLs collected from Facebook were analyzed using ten predefined structural detection rules. Jaccard similarity was calculated by comparing token sets before and after canonicalization. The results show that 292 URLs (29.2%) matched at least one detection rule, producing 329 detections. Long URLs (140 detections), excessive dashes (88), excessive subdomains (46), and URL shorteners (42) accounted for 96.0% of all detections. The average Jaccard similarity was 0.9991, while Hex/URL Encoding exhibited a median value of 0.934. These findings characterize the structural patterns captured by the proposed rules and indicate that Jaccard similarity distinguishes changes in token composition more clearly for encoding-related cases than for most structurally detected cases.Keywords: Canonicalization, Cybersecurity, Facebook, Jaccard similarity, Phishing URL, URL obfuscation]]>
Copyrights © 2026
