Url’s folder name length as a phishing detection feature

Abstract

Phishing is a cybercrime in which, the phishers try to control users’ credentials. The phishers usually construct fake URLs that take to phishing websites where the users might disclose, and loss their credentials. This paper introduces a new feature to detect phishing URLs. The length of folder name of URL’s path is utilized in this work as a phishing detection feature, namely FldrNmLnth. Results from analysis of two email datasets show that many of phishing URLs are constructed using upto 230 characters as names of their folders’ names. The length of folders’ names of legitimate URLs, on the other side, has not exceeded 30 characters. This length variance motivates the use of folder name length as a feature to detect phishing URLs. © The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd 2021.