Data and Code for Phishing Detection Bias Study on Bangladeshi Web Infrastructure

This repository contains the dataset, feature-extraction pipeline, and analysis scripts accompanying an empirical study on phishing detection bias against Bangladeshi web infrastructure. The study evaluates a Random Forest classifier trained on the UCI Phishing Websites benchmark (96.7% accuracy) against a novel test set of 178 independently-verified legitimate Bangladeshi government, banking, telecommunications, and higher-education domains, alongside 300 live phishing URLs sourced from the OpenPhish feed. Accuracy on legitimate Bangladeshi domains fell to 65.2%, a statistically significant 31.6 percentage-point gap (p = 4.25 x 10^-34). Through feature-level diagnosis and independent third-party verification (SSL Labs, direct WHOIS reproduction), three mechanisms were identified: systematic WHOIS non-response for .gov.bd/.org.bd domains (confirmed across 29 domains, 100% non-response rate), SSL/TLS certificate chain and hostname misconfigurations (confirmed via SSL Labs in 68.8% of a verified sub-sample), and outdated heuristic features calibrated on a 2015 dataset. An ablation study empirically tested proposed corrections for each mechanism. Contents: Curated list of 178 verified Bangladeshi legitimate domains (government, banking, telecom, education) Feature-extraction pipeline (25 live-extracted features per URL: SSL/TLS validation, WHOIS lookup, DNS resolution, HTML parsing) Full extraction results dataset (478 URLs x 29 features, CSV) Baseline model training script (UCI Phishing Websites dataset) Bias diagnosis and root-cause analysis scripts WHOIS verification scripts Keywords: phishing detection, machine learning, algorithmic bias, cybersecurity, Bangladesh, Global South, SSL/TLS, WHOIS, domain infrastructure