Datasets for Phishing Websites Detection

In this repository the two variants of the phishing dataset are presented.

Web application

To preview the dataset interactively and/or tailor it to your needs, please visit a dedicated web application.

dataset_full.csv

Short description of the full variant dataset: - Total number of instances: 88,647 - Number of legitimate website instances (labeled as 0): 58,000 - Number of phishing website instances (labeled as 1): 30,647 - Total number of features: 111 (without target)

dataset_small.csv

Short description of the small variant dataset: - Total number of instances: 58,645 - Number of legitimate website instances (labeled as 0): 27,998 - Number of phishing website instances (labeled as 1): 30,647 - Total number of features: 111 (without target)

Extracted Features

| Feature | Description | |----------------------------|----------------------------------------------------| | qtydoturl | count (.) in URL | | qtyhyphenurl | count (-) in URL | | qtyunderlineurl | count () in URL | | qtyslashurl | count (/) in URL | | qtyquestionmarkurl | count (?) in URL | | qtyequalurl | count (=) in URL | | qtyaturl | count (@) in URL | | qtyandurl | count (&) in URL | | qtyexclamationurl | count (!) in URL | | qtyspaceurl | count ( ) in URL | | qtytildeurl | count (~) in URL | | qtycommaurl | count (,) in URL | | qtyplusurl | count (+) in URL | | qtyasteriskurl | count (*) in URL | | qtyhashtagurl | count (#) in URL | | qtydollarurl | count ($) in URL | | qtypercenturl | count (%) in URL | | qtytldurl | top-level-domain length | | lengthurl | URL length | | qtydotdomain | count (.) in domain | | qtyhyphendomain | count (-) in domain | | qtyunderlinedomain | count () in domain | | qtyslashdomain | count (/) in domain | | qtyquestionmarkdomain | count (?) in domain | | qtyequaldomain | count (=) in domain | | qtyatdomain | count (@) in domain | | qtyanddomain | count (&) in domain | | qtyexclamationdomain | count (!) in domain | | qtyspacedomain | count ( ) in domain | | qtytildedomain | count (~) in domain | | qtycommadomain | count (,) in domain | | qtyplusdomain | count (+) in domain | | qtyasteriskdomain | count (*) in domain | | qtyhashtagdomain | count (#) in domain | | qtydollardomain | count ($) in domain | | qtypercentdomain | count (%) in domain | | qtyvowelsdomain | count vowels in domain | | domainlength | domain length | | domaininip | URL domain in IP address format | | serverclientdomain | domain contains the keywords "server" or "client" | | qtydotdirectory | count (.) in directory | | qtyhyphendirectory | count (-) in directory | | qtyunderlinedirectory | count () in directory | | qtyslashdirectory | count (/) in directory | | qtyquestionmarkdirectory | count (?) in directory | | qtyequaldirectory | count (=) in directory | | qtyatdirectory | count (@) in directory | | qtyanddirectory | count (&) in directory | | qtyexclamationdirectory | count (!) in directory | | qtyspacedirectory | count ( ) in directory | | qtytildedirectory | count (~) in directory | | qtycommadirectory | count (,) in directory | | qtyplusdirectory | count (+) in directory | | qtyasteriskdirectory | count (*) in directory | | qtyhashtagdirectory | count (#) in directory | | qtydollardirectory | count ($) in directory | | qtypercentdirectory | count (%) in directory | | directorylength | directory length | | qtydotfile | count (.) in file | | qtyhyphenfile | count (-) in file | | qtyunderlinefile | count () in file | | qtyslashfile | count (/) in file | | qtyquestionmarkfile | count (?) in file | | qtyequalfile | count (=) in file | | qtyatfile | count (@) in file | | qtyandfile | count (&) in file | | qtyexclamationfile | count (!) in file | | qtyspacefile | count ( ) in file | | qtytildefile | count (~) in file | | qtycommafile | count (,) in file | | qtyplusfile | count (+) in file | | qtyasteriskfile | count (*) in file | | qtyhashtagfile | count (#) in file | | qtydollarfile | count ($) in file | | qtypercentfile | count (%) in file | | filelength | file length | | qtydotparams | count (.) in parameters | | qtyhyphenparams | count (-) in parameters | | qtyunderlineparams | count () in parameters | | qtyslashparams | count (/) in parameters | | qtyquestionmarkparams | count (?) in parameters | | qtyequalparams | count (=) in parameters | | qtyatparams | count (@) in parameters | | qtyandparams | count (&) in parameters | | qtyexclamationparams | count (!) in parameters | | qtyspaceparams | count ( ) in parameters | | qtytildeparams | count (~) in parameters | | qtycommaparams | count (,) in parameters | | qtyplusparams | count (+) in parameters | | qtyasteriskparams | count (*) in parameters | | qtyhashtagparams | count (#) in parameters | | qtydollarparams | count ($) in parameters | | qtypercentparams | count (%) in parameters | | paramslength | parameters length | | tldpresentparams | TLD presence in arguments | | qtyparams | number of parameters | | emailinurl | email present in URL | | timeresponse | search time (response) domain (lookup) | | domainspf | domain has SPF | | asnip | AS Number (or ASN) | | timedomainactivation | time (in days) of domain activation | | timedomainexpiration | time (in days) of domain expiration | | qtyipresolved | number of resolved IPs | | qtynameservers | number of resolved name servers (NameServers - NS) | | qtymxservers | number of MX Servers | | ttlhostname | time-to-live (TTL) value associated with hostname | | tlssslcertificate | valid TLS / SSL Certificate | | qtyredirects | number of redirects | | urlgoogleindex | check if URL is indexed on Google | | domaingoogleindex | check if domain is indexed on Google | | urlshortened | check if URL is shortened | | phishing | is phishing website |

Cite this dataset

G. Vrbančič, I. Jr. Fister, V. Podgorelec. Datasets for Phishing Websites Detection. Data in Brief, Vol. 33, 2020, DOI: 10.1016/j.dib.2020.106438