URL-Only Phishing Detection Based on Structural and Character-Level Lexical Fusion Using TF-IDF and LightGBM

Phishing URLs are commonly used for credential
theft and online fraud. This study presents a URL-only phishing
detector using the raw URL and class label from the PhiUSIIL
dataset. The method combines LightGBM trained on 38 fixed
structural lexical features with Logistic Regression trained on
character-level TF-IDF URL representations. Component configurations, fusion weights, and classification thresholds are selected
through inner validation. Five registrable-domain/IP-disjoint
outer folds ensure that URLs from the same registrable domain or
IP-address group do not cross training–test boundaries. Across
234,604 cleaned URLs, the method achieved 99.81% accuracy,
99.96% precision, 99.59% recall, and a 99.78% F1-score from
pooled held-out predictions. All comparison models also received
inner-validation configuration and threshold selection. Holmadjusted exact paired McNemar tests showed significant paired
correctness advantages over six of seven comparison models; the
small numerical advantage over Extra Trees was not statistically
significant. The complete artifact averaged 7.60 MB, with batch
scoring of 0.191 ms per URL. In a contextual comparison with
selected PhiUSIIL studies, the proposed method achieved 0.02
percentage points higher accuracy than the highest reported
result, although evaluation protocols differ