What if a computer could tell a fake website is fake just by looking at its features? Turns out, yes. Here's how I built my first real machine learning project.
The Problem: Phishing Is Everywhere
If you've ever gotten a message saying "Your bank account is suspended, click here now," you've seen phishing in action — fake websites disguised as real ones, built to steal your password or credit card number.
Traditional defenses (blacklists of known bad URLs) are always playing catch-up. Attackers spin up new fake domains faster than blacklists can be updated.
The Idea: Teach the Pattern, Not the List
Instead of memorizing bad URLs, what if a model learned the shared traits of phishing sites? Things like:
- Does the site have a valid SSL certificate?
- Do the page's internal links point somewhere suspicious?
- Is the domain brand new or well-established?
The Experiment
I used the UCI Phishing Websites dataset — 11,055 real websites, each labeled phishing or legitimate, described by 30 features.
I trained and compared three classic ML algorithms on a held-out test set (80/20 split):
| Algorithm | Accuracy |
|---|---|
| Logistic Regression | 92.45% |
| Random Forest | 96.70% 🏆 |
| SVM | 94.71% |
5-fold cross-validation gave consistent results.
The Most Surprising Part
When I checked which features mattered most, SSL certificate state and anchor link behavior dominated — by a wide margin over the other 28 features.
Why? Likely because phishing sites often:
- Can't get a valid SSL certificate for a fake domain
- Copy the real site's design, so internal links accidentally point back to the real domain
This is my interpretation of the result, not something the experiment proved. But the model found this pattern on its own — I never told it to focus on SSL.
The Real Takeaway
The biggest lesson: you don't need to be an expert to start. The dataset was ready-made, the tools (Python + scikit-learn) are free, and the steps are well-documented. What it actually took was patience and consistency.
Full code and details are on GitHub:
🔗 https://github.com/eln2mac-has/phishing-detection-ml
📄 Full paper (preprint): https://doi.org/10.5281/zenodo.23515452
If you try something similar or have questions, drop a comment below 👇
Top comments (0)