URL-Phish: A Feature-Engineered Dataset for Phishing Detection

This dataset, named URL-Phish, is designed for phishing detection research. It contains 116 600 unique URLs divided into:
• 100 000 benign samples (label = 0), collected from trusted sources including educational (.edu), governmental (.gov), and top-ranked domains. The benign dataset was obtained from the Research Organization Registry [1].
• 16 600 phishing samples (label = 1), obtained from the PhishTank repository [2] between November 2024 and September 2025.
Each URL entry was automatically processed to extract 22 lexical and structural features, such as URL length, domain length, number of subdomains, digit ratio, entropy, and HTTPS usage. In addition, three reference columns (url, dom, tld) are preserved for interpretability. One label column is included (0 = benign, 1 = phishing).
A data cleaning step removed duplicates and empty entries, followed by normalization of features to ensure consistency. The dataset is provided in CSV format, with 22 numerical feature columns, 3 string reference columns, and 1 label column (total = 26 columns).

References
[1] Research Organization Registry, “ROR Data.” Zenodo, Sept. 22, 2025. doi: 10.5281/ZENODO.6347574.
[2] PhishTank, “PhishTank: Join the fight against phishing.” [Online]. Available: https://phishtank.org