URL Analysis 101

A malicious link is often all an attacker needs. Phishing URLs are built to survive a quick glance: a trusted brand buried in a subdomain, a single missing letter, a top-level domain nobody registered, or a redirect hidden behind a shortener. Reading a URL correctly is a skill, and at scale it has to be automated.

This section covers both halves of the problem — spotting manipulation by eye, and detecting it in volume.

• A Beginner’s Guide to Phishing URLs - The anatomy of a URL and why it should be read right to left, followed by the manipulation techniques that exploit it: subdomain, TLD and typo cybersquatting, suggestive words, soft hyphens, hex encoding, short URLs, and HTML concealment.
• Automating Phishing Investigations with Machine Learning - List-based detection versus machine learning, the trade-offs of each, and a worked example turning URLs into feature vectors and separating phishing from trusted with an SVM.