Beyond Benchmark Accuracy: A Hybrid Framework for Phishing URL and Email Detection

Phishing detectors can achieve almost perfect accuracy on benchmark datasets and still struggle with the links people encounter in practice. This paper investigates that gap and describes a hybrid framework for assessing URLs and emails through machine learning, language analysis, header inspection, and transparent rules. Our URL model combines character-level TF-IDF with 17 lexical features in a logistic regression classifier. Analysis of the 235,795 URLs in PhiUSIIL revealed pronounced differences in how the two classes were represented: every legitimate example used a simple HTTPS domain format, while 59.9% of phishing URLs included a path and 51.3% used HTTP. A classifier trained on raw URLs achieved 99.71% test accuracy, yet incorrectly marked 26 of 30 ordinary legitimate links as phishing. To limit reliance on these patterns, we trained a second classifier on 197,591 unique registered domains. On held-out domains, it achieved 86.02% accuracy, a ROC-AUC of 0.892, and 89.02% phishing precision. We then combined its predictions with URL-pattern checks, NLTK-based email cues, and SPF, DKIM, and DMARC evidence in a Flask prototype that reports a risk score and supporting reasons. The results show why dataset composition and realistic tests matter as much as headline accuracy when evaluating phishing detection.