A Hybrid Machine Learning and Domain Reputation Framework for Phishing URL Detection

Abstract

Phishing attacks remain one of the most prevalent cybersecurity threats, exploiting deceptive URLs and fraudulent domains to steal sensitive user information. Traditional phishing detection techniques, such as blacklist-based and rule-based systems, are largely reactive and ineffective against zero-day and short-lived phishing websites. To address these limitations, this paper proposes a hybrid phishing detection framework that integrates machine learning–based URL analysis with domain reputation assessment using DNS and SSL certificate indicators. The proposed approach employs an Extreme Gradient Boosting (XGBoost) classifier to analyze lexical and structural URL features, while trust-based indicators derived from DNS resolution and SSL certificate validation provide complementary contextual verification. A weighted hybrid decision strategy is adopted to combine both components, improving robustness and reducing false-positive rates. Experimental evaluation conducted on a balanced dataset of phishing and legitimate URLs demonstrates the effectiveness of the proposed framework, achieving an overall detection accuracy of 99% with high precision, recall, and F1-score values. The results further indicate strong generalization capability and excellent class separability, as evidenced by ROC and Precision–Recall analysis. The proposed framework offers a scalable, lightweight, and real-time phishing detection solution without reliance on proprietary or paid threat intelligence services, making it suitable for practical deployment in real-world cybersecurity environments.