# URLTran: Improving Phishing URL Detection Using Transformers

arXiv: https://arxiv.org/abs/2106.05256 · HTML: https://mlsanity.com/paper/2106.05256/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Jun 2021.

## Built on by (most cited first, 18 of 18)

- [KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection](https://mlsanity.com/paper/2403.02253/) (2024)
- [An Improved Transformer-based Model for Detecting Phishing, Spam, and Ham: A Large Language Model Approach](https://mlsanity.com/paper/2311.04913/) (2023)
- [An Explainable Transformer-based Model for Phishing Email Detection: A Large Language Model Approach](https://mlsanity.com/paper/2402.13871/) (2024)
- [Web Content Filtering through knowledge distillation of Large Language Models](https://mlsanity.com/paper/2305.05027/) (2023)
- [LLMs are One-Shot URL Classifiers and Explainers](https://mlsanity.com/paper/2409.14306/) (2024)
- [DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification](https://mlsanity.com/paper/2409.09143/) (2024)
- [From Texts to Shields: Convergence of Large Language Models and Cybersecurity](https://mlsanity.com/paper/2505.00841/) (2025)
- [PhishDebate: An LLM-Based Multi-Agent Framework for Phishing Website Detection](https://mlsanity.com/paper/2506.15656/) (2025)
- [A Unique Training Strategy to Enhance Language Models Capabilities for Health Mention Detection from Social Media Content](https://mlsanity.com/paper/2310.19057/) (2023)
- [From Past to Present: A Survey of Malicious URL Detection Techniques, Datasets and Code Repositories](https://mlsanity.com/paper/2504.16449/) (2025)
- [AI-in-the-Loop: Privacy Preserving Real-Time Scam Detection and Conversational Scambaiting by Leveraging LLMs and Federated Learning](https://mlsanity.com/paper/2509.05362/) (2025)
- [MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs](https://mlsanity.com/paper/2601.18113/) (2026)
- [MemoPhishAgent: Memory-Augmented Multi-Modal LLM Agent for Phishing URL Detection](https://mlsanity.com/paper/2602.21394/) (2026)
- [A Review of Data-driven Approaches for Malicious Website Detection](https://mlsanity.com/paper/2305.09084/) (2023)
- [A Graph-Attentive LSTM Model for Malicious URL Detection](https://mlsanity.com/paper/2510.15971/) (2025)
- [Eliciting Least-to-Most Reasoning for Phishing URL Detection](https://mlsanity.com/paper/2601.20270/) (2026)
- [Iterative Definition Refinement for Zero-Shot Classification via LLM-Based Semantic Prototype Optimization](https://mlsanity.com/paper/2604.27335/) (2026)
- [AURA: Adaptive Uncertainty-Routed Analysis for Email Threat Detection](https://mlsanity.com/paper/2609.19873/) (2026)

## Abstract (arXiv)

Browsers often include security features to detect phishing web pages. In the past, some browsers evaluated an unknown URL for inclusion in a list of known phishing pages. However, as the number of URLs and known phishing pages continued to increase at a rapid pace, browsers started to include one or more machine learning classifiers as part of their security services that aim to better protect end users from harm. While additional information could be used, browsers typically evaluate every unknown URL using some classifier in order to quickly detect these phishing pages. Early phishing detection used standard machine learning classifiers, but recent research has instead proposed the use of deep learning models for the phishing URL detection task. Concurrently, text embedding research using transformers has led to state-of-the-art results in many natural language processing tasks. In this work, we perform a comprehensive analysis of transformer models on the phishing URL detection task. We consider standard masked language model and additional domain-specific pre-training tasks, and compare these models to fine-tuned BERT and RoBERTa models. Combining the insights from these experiments, we propose URLTran which uses transformers to significantly improve the performance of phishing URL detection over a wide range of very low false positive rates (FPRs) compared to other deep learning-based methods. For example, URLTran yields a true positive rate (TPR) of 86.80% compared to 71.20% for the next best baseline at an FPR of 0.01%, resulting in a relative improvement of over 21.9%. Further, we consider some classical adversarial black-box phishing attacks such as those based on homoglyphs and compound word splits to improve the robustness of URLTran. We consider additional fine tuning with these adversarial samples and demonstrate that URLTran can maintain low FPRs under these scenarios.