Spoofed website addresses are the oldest trick in the phishing playbook and still one of the most effective, which is why a new accuracy figure attached to them travels fast. A team of Indian researchers has reported a hybrid deep-learning classifier that reads a web address as a string of characters and decides whether it is genuine or faked, scoring 98.9% on one benchmark set of spoofed website addresses and 96.8% on another. Rounded up, that is the “up to 99% accuracy” headline now circulating.
The work appears in the International Journal of Electronic Security and Digital Forensics under the title “A hybrid deep learning method for URL spoofing in websites”. It combines a convolutional neural network with a long short-term memory network, and the paper’s claim is narrow and testable: the pair together classifies spoofed website addresses better than either component alone. That is a useful result. It is also a much smaller claim than “AI has solved phishing”, and the distance between the two is where this article lives. Broader context on where such models sit is covered in our artificial intelligence hub.
What follows reads the study as published, converts its percentages into the error rates a security team would actually feel, sets the result against the ways attackers build convincing spoofed website addresses, and asks the question the abstract does not: what does a character-level classifier miss, and what has to sit behind it. It also flags something the citation makes plain — this paper was accepted in October 2024 and published online in September 2026, a gap that matters in a field where attacker tooling turns over in months.
Table of contents
- What the Study Actually Tested on Spoofed Website Addresses
- How a CNN-LSTM Hybrid Reads Spoofed Website Addresses
- The 99% Figure on Spoofed Website Addresses Deserves a Closer Look
- Why Spoofed Website Addresses Still Fool People
- Where Address Classification Fits in a Real Defence Stack
- A Short History of Detecting Spoofed Website Addresses
- Deploying Detection for Spoofed Website Addresses Without Breaking Things
- The Publication Gap Behind This Result
- Frequently Asked Questions About Spoofed Website Addresses
- References
What the Study Actually Tested on Spoofed Website Addresses
The abstract is short, so it is worth being precise about what was and was not measured before drawing conclusions from the numbers.
The model reads the address, not the page
This is the single most important design decision in the paper. The classifier reads spoofed website addresses as plain text: it takes the uniform resource locator itself — the characters between https:// and the end of the query string — and treats it as a sequence. It does not fetch the page, render it, compare the logo against a brand database, check the certificate chain, or look at the age of the domain. Everything the model knows about spoofed website addresses, it knows from their spelling.
That is a genuine advantage and a genuine constraint at the same time. The advantage is speed and safety: you can classify a link without visiting it, which means the check can run inside a mail gateway or a browser extension before a user is ever exposed. The constraint is that any deception which lives in the page rather than the address is invisible to it, so spoofed website addresses are the only thing it is equipped to judge.
The two datasets, and why they differ
The paper reports results on two datasets it names UCL and PhishTank. PhishTank is a long-running community clearing house where analysts submit and verify live phishing URLs, so it is a stream of spoofed website addresses attackers were actually using. The “UCL” set is the more curious label: the widely used academic benchmark in this space is the UCI Machine Learning Repository’s phishing websites collection, and the abstract does not disambiguate the two. We flag it rather than assume it.
The distinction is not pedantry. A curated academic dataset tends to be cleaner, better balanced and older; a live feed is messier and closer to current attacker behaviour. A model scoring higher on curated spoofed website addresses than on live ones is telling you something, and in this case it scored 2.1 percentage points higher.
The numbers, exactly as reported
| Dataset | Reported accuracy | Errors per 1,000 addresses | What the set represents |
|---|---|---|---|
| UCL | 98.9% | 11 | Curated academic benchmark |
| PhishTank | 96.8% | 32 | Community-verified live feed |
| Gap | 2.1 points | 21 more errors | Curated minus live |
The right-hand column is the one to sit with. Twenty-one extra mistakes per thousand does not sound like much until you multiply it by the volume of links a mid-sized organisation touches in a week, of which spoofed website addresses are a small but costly slice.
How a CNN-LSTM Hybrid Reads Spoofed Website Addresses
The architecture is not exotic. It is a well-established pairing, and understanding why it is used here explains both the result and its limits.
What the convolutional layer contributes
A convolutional neural network slides small filters across the input and learns to recognise local patterns wherever they occur. Applied to characters rather than pixels, it becomes a detector for the short suspicious fragments that give spoofed website addresses away: a doubled letter, a digit standing in for a letter, a hyphen where a dot belongs, a brand name followed by an unexpected suffix. Crucially it is position-independent — it will spot the same fragment at the start of a host name or buried in a path.
What the LSTM layer contributes
A long short-term memory network reads the sequence in order and carries state forward, which lets it learn about structure rather than fragments. In spoofed website addresses the structure is usually the point: where the host ends and the path begins, how many subdomain labels there are, whether the brand name appears in the registrable domain or only in a subdomain that anyone can create. That ordering information is exactly what a convolution discards.
Why the hybrid beats either half
Put plainly, the convolution answers “does this contain anything odd?” and the memory network answers “is it odd in the right place?”. Spoofed website addresses usually fail on both counts at once, but the strongest fakes fail on only one — a perfectly ordinary-looking brand string sitting in a position it has no business occupying. The paper’s stated goal is to use the best parts of both methods, and the reported figures are the evidence offered for it.
The 99% Figure on Spoofed Website Addresses Deserves a Closer Look
Nothing here is wrong. But accuracy is a blunt instrument, and reading it as a grade out of a hundred leads teams to the wrong operational conclusions.
Accuracy is the wrong headline metric for phishing
Accuracy is the share of all decisions that were correct. It says nothing about how a model’s errors on spoofed website addresses split between the two kinds that matter, and those two kinds have wildly different costs. A false negative is one of the spoofed website addresses waved through to a user. A false positive is a legitimate address blocked, which generates a helpdesk ticket, erodes trust in the control, and eventually gets the control switched off.
A model can post a superb accuracy score while making almost all of its mistakes in the expensive direction. The abstract reports accuracy on both datasets and does not report precision, recall, F1 or a confusion matrix, so from the published summary alone there is no way to tell which direction this one leans.
The 1.1% that gets through
Take the better of the two figures at face value. On the UCL set, 1.1% of decisions are wrong — eleven per thousand. An organisation whose staff collectively encounter 50,000 links a week would see roughly 550 wrong calls in that week, some share of them spoofed website addresses delivered straight to an inbox. The model is not the last line of defence against spoofed website addresses; it is a filter that changes the volume reaching the next line.
What the paper does not report
Three omissions in the abstract are worth naming, not as criticisms of the work but as gaps a buyer must close before treating the number as a product claim.
The first is class balance. If a test set is 90% benign, a model that answers “benign” every time scores 90% before it learns anything. The second is inference cost — a gateway decision has a latency budget measured in milliseconds, and a hybrid stack is heavier than a feature-based classifier. The third is adversarial robustness: nothing in the published summary describes testing against spoofed website addresses constructed specifically to defeat a character-level model.
Why Spoofed Website Addresses Still Fool People
The classifier exists because the attack works, and spoofed website addresses work because human reading is not character-by-character comparison.
The techniques, and what a string classifier can see
| Technique | What it looks like | Visible in the address string? |
|---|---|---|
| Typosquatting | One letter added, dropped or swapped | Yes — strong signal |
| Homoglyphs | Characters that look alike across scripts | Yes, if encoding is preserved |
| Subdomain stuffing | Brand name pushed into a subdomain label | Yes — structural, suits the LSTM |
| Combosquatting | Brand plus a plausible extra word | Partly — the string is legitimate-looking |
| Compromised legitimate site | A real, trusted domain serving a fake page | No — the address is genuine |
| Link shorteners and redirect chains | An opaque address that resolves elsewhere | No — the payload is behind a hop |
The bottom two rows are the honest limit. A hosted form on a hijacked but legitimate domain produces no spoofed address at all, and no amount of accuracy on spoofed website addresses touches it.
The human factor is not a technical loophole
Phishing persists because it exploits attention rather than a flaw in a protocol. A distracted person reading a plausible message under time pressure does not audit a host name for the marks of spoofed website addresses; they recognise a brand shape and click. That is why automating the check has such leverage — the machine is unhurried and reads every character — and equally why detection alone cannot be the whole programme. Sound cybersecurity practice pairs the filter with reporting routes, credential hygiene and phishing-resistant authentication.
Where Address Classification Fits in a Real Defence Stack
A model that scores 98.9% on spoofed website addresses is a layer, and layers only make sense in relation to the layers around them.
| Control | Catches | Misses |
|---|---|---|
| Blocklist lookup | Known bad addresses, instantly | Anything registered in the last hour |
| Character-level classifier | Novel spoofed website addresses by shape | Genuine domains serving fake pages |
| Page content analysis | Cloned login forms on any domain | Requires fetching the page |
| Phishing-resistant MFA | Credential replay after a successful lure | Nothing upstream of the login |
| User reporting | Campaigns every automated layer missed | Depends on people noticing |
Read down the “misses” column and the shape of a sensible programme appears on its own. Each layer’s blind spot is another layer’s specialism, which is the argument for a classifier that runs early and cheaply rather than one that tries to be definitive.
The lookalike-domain problem
There is a commercial wrinkle worth stating. Detecting spoofed website addresses aimed at your brand is a different job from detecting them generally, and it is the one most organisations actually want. That job needs registration monitoring and certificate transparency feeds, not a general classifier — you want to know the moment a near-miss of your domain is registered, ideally before anyone receives a link to it.
A Short History of Detecting Spoofed Website Addresses
The hybrid in this paper is a step on a path, and the path explains why character-level models became the default research direction.
Rules and blocklists came first
The earliest defences against spoofed website addresses were lists. A vendor collected confirmed bad addresses, distributed them, and browsers refused to load anything on the list. Exact matching is fast, cheap and completely unambiguous, and it is still the first check in most stacks. Its weakness has never changed: a list can only contain what somebody has already reported, and a domain registered twenty minutes ago is on nobody’s list.
Hand-built features came second
The next generation extracted features a human analyst thought were meaningful — address length, count of dots, presence of an IP literal instead of a host name, count of hyphens, whether the address used a shortener. These were fed to a conventional classifier such as a random forest. This approach worked well and remains competitive, but every feature is a hypothesis a person wrote down, so the model can only notice the kinds of spoofed website addresses somebody thought to describe.
Learned representations came third
Character-level deep learning removed the analyst from that loop. Instead of being told which properties matter, the model is shown large numbers of labelled examples and learns its own internal representation of what a faked one looks like. That is the family this paper belongs to, and the trade is explicit: you gain the ability to catch patterns nobody enumerated, and you lose the ability to explain in one sentence why a given address was flagged. For a control that blocks traffic, that loss of explainability is not academic — it is what the appeal path has to absorb.
Deploying Detection for Spoofed Website Addresses Without Breaking Things
If a model like this reached your environment tomorrow, the failure mode would not be technical. It would be that someone turned it to blocking on day one.
Run it in shadow mode first
Score every link for spoofed website addresses, block nothing, and log the disagreements between the model and your existing control. Two weeks of that produces a real false-positive rate on your own traffic, which is the only rate that matters. Vendor and benchmark figures for spoofed website addresses are measured on distributions that are not yours.
Budget the helpdesk cost explicitly
Those bars are the reported percentages multiplied by 50,000, nothing more. They are not a prediction about your estate; they are an illustration of how a two-point gap in accuracy on spoofed website addresses converts into a workload. Treat the exercise as the template and substitute your own link volume.
Decide who owns the appeal path
Every blocked legitimate address needs a route back. Name the owner, set a target turnaround, and measure it. Controls that block spoofed website addresses die from unresolved tickets far more often than from evasion, and that is an operational question rather than a modelling one — the same discipline any managed IT service applies to change control.
The Publication Gap Behind This Result
The citation carries three dates, and together they say something the headline does not.
Twenty-six months from submission to publication
The paper was received on 6 July 2024, accepted on 10 October 2024, and published online on 7 September 2026. That is roughly three months in review and a further twenty-three months to appear, twenty-six months in total.
Why the gap matters here more than elsewhere
For most research a two-year lag is unremarkable. For adversarial detection it is a substantive caveat, because the thing being detected changes in response to the detector. The attacker tooling that generated the spoofed website addresses in the PhishTank entries this model was tested against is two years old. Generative tooling has since made it trivial to produce large volumes of plausible domain strings, which is precisely the kind of spoofed website addresses a character-level model is most exposed to.
None of that invalidates the architecture. It does mean the honest reading is “this pairing works on this problem”, not “this is the current state of the art against today’s spoofed website addresses”. A team evaluating the approach should re-run it on a contemporary feed before quoting the figure internally, and treat the published result as a starting point for their own data analytics work rather than a finished benchmark.
Frequently Asked Questions About Spoofed Website Addresses
Is 99% accuracy good enough to block links automatically?
Not on its own, and not on day one. Accuracy alone does not tell you how the errors on spoofed website addresses split between blocked-legitimate and allowed-malicious, and only the first of those generates visible pain. Run in shadow mode, measure both rates on your own traffic, then decide.
Does this replace a blocklist?
No — it complements one. A blocklist is exact and instant on things already known to be bad; a classifier generalises to spoofed website addresses nobody has seen. Running both means the cheap exact check handles the bulk and the model handles the novelty.
What about a phishing page on a legitimate domain?
A character-level model cannot see it, because there is nothing wrong with the address. That case belongs to page-content analysis and to authentication that cannot be replayed. It is the clearest reason detection of spoofed website addresses is a layer rather than a solution.
Can attackers train against a published model?
In principle yes, and this is the standing weakness of any published detector. The mitigation is not secrecy but layering and retraining: a model refreshed on a current feed, sitting behind controls whose failure modes are unrelated to string shape.
Should we build this ourselves?
Rarely. The architecture is well documented and the datasets of spoofed website addresses are public, so a proof of concept is a week’s work — but the ongoing cost is retraining, monitoring drift and staffing the appeal path. Most organisations get more value from tuning the controls they already own than from owning a classifier.
References
A hybrid deep learning method for URL spoofing in websites
International Journal of Electronic Security and Digital Forensics
AI model spots spoofed website addresses with up to 99% accuracy
UCI Machine Learning Repository: Phishing Websites
APWG Phishing Activity Trends Reports