Evidence, with its limits.

What happens when you analyze a link?

1. The browser parses the address and identifies its actual host and registrable domain using the Public Suffix List, including private suffixes.
2. It extracts 14 registrable-domain-shape features, excluding protocol, www, subdomains, paths and query strings, using the same JavaScript code used to prepare the training data.
3. The deployed logistic model combines 14 domain-shape features with training-only TF-IDF character patterns. Protocol, www, subdomains, paths and queries are excluded to reduce source shortcuts. URL-only evidence requests review; high verdicts are reserved for named password controls submitting over HTTP in an uploaded snapshot. The classification thresholds were chosen on validation data.
4. Observable rule findings are displayed separately. An uploaded HTML snapshot may contribute additional contextual findings.

A domain score is not a guarantee

The score is not a verified probability that a site is fraudulent. No strong detected indicators does not mean safe. HTTPS, Arabic domain names and domain length alone cannot establish authenticity.

Reproducible research

PhiUSIIL (UCI 967, 2024) contains 235,795 source records. Source labels are explicitly mapped from 0=phishing / 1=legitimate to internal phishing=1. Only URL and label were used; all provided feature columns were excluded.

Canonical duplicates and conflicting labels are handled before splitting. Registrable-domain groups do not overlap between training, validation and final test. Scaling is fit on training data only. Original rules, logistic regression and Random Forest are compared. An initial test corpus was reused during revisions and is reported as exploratory. A separate PhreshPhish cohort was evaluated only after the deployed model and thresholds were frozen.

Data flow & privacy

URL analysis and uploaded HTML analysis happen in this browser. The input is not sent to a scan API, stored in a database or saved to browser storage. Model files and the application itself are downloaded from this Site. There is no clipboard monitoring or behavioral analytics in the application. Hosting access logs are controlled by the platform.

Downloaded reports redact user information, query values and fragments from the displayed URL. Paths, destination domains and the page title may still be sensitive: review before sharing.

What this release cannot establish

• A separate PhreshPhish test measures cross-source performance, with increased false positives. Universal generalization and sufficient Arabic-language performance have not been established.
• Compromised legitimate pages may have ordinary-looking URLs. Fake shops, false claims and malware need different evidence.
• Uploaded HTML may be stale or unrelated to the supplied URL. Scripts, subresources and forms are never executed.
• The three-brand reference is limited and is not an allowlist certifying a site. External login services can be legitimate.

Primary sources

• PhiUSIIL — UCI / Prasad & Chandra, CC BY 4.0
• Phishpedia — USENIX Security 2021
• scikit-learn — Data leakage and preprocessing
• OWASP — SSRF prevention