Phishing webpage detection using structured URL generation

Phishing attacks remain a persistent threat in cybersecurity. Attackers continuously create deceptive webpages to trick users. As a result, the cybersecurity research community needs to build detection systems that can keep pace. Many existing methods rely on fixed-length padding to handle variable-length URLs, resulting in sparse inputs and reduced classifier performance in unknown data. We propose an augmentation framework that improves phishing detection by completing short or partial URLs before classification. We split each URL into a prefix and a target, train a character-level generator to produce realistic completions conditioned on the prefix, and add these completions to the training set alongside the original URLs. Then, a page-level classifier takes the main URL and all embedded URLs within a webpage as input. It predicts whether the page is phishing or benign. We evaluate the framework on a dataset of 31,462 webpages collected from Alexa and PhishTank. Across five random seeds, the Full Model achieves a mean AUC of 0.9425 (0.0029), compared with 0.9381 (0.0024) for the baseline, and improves recall from 0.8732 to 0.8857. A paired t-test confirms the gains are statistically significant ( \(t = 4.49\) , \(p = 0.0109\) ). A control experiment with random valid suffixes confirms that the learned generator contributes beyond simply adding character mass; random suffixes hurt recall, while the learned generator substantially improves it. The method reduces target tensor sparsity by 32.90 % points for short URLs. It maintains strong performance even when 50% of embedded URLs are missing during inference. These results show that prefix-conditioned URL completion provides a practical and effective augmentation strategy for phishing detection, improving recall while keeping false positives low.