Skip to content
Model architecture: URL features feeding an LSTM and a 1D CNN in parallel, merged into dense layers
04 / CASE STUDY

PHISHING URL DETECTION

AIMLSecurity
2025
0.90
ACCURACY
0.91
F1 — PHISHING
0.93
RECALL — PHISHING
90
FEATURES
THE CHALLENGE

Phishing URLs mutate constantly, so static blocklists and hand-written rules go stale almost as soon as they ship — and letting one through costs far more than a false alarm.

THE SOLUTION

A hybrid CNN + LSTM model reads 90 engineered features per URL — structure, domain data, page behaviour, WHOIS/DNS — and classifies it as phishing or legitimate.

THE RESULT

90% accuracy on 2,286 held-out URLs, deliberately tuned toward catching phishing over avoiding false alarms — the more expensive error.

Classification report: precision, recall and F1 per class across 2,286 test URLs

HAVE SOMETHING SIMILAR IN MIND?

Tell us what you're building — we'll be direct about scope, cost and timeline.