# From Past to Present: A Survey of Malicious URL Detection Techniques, Datasets and Code Repositories

arXiv: https://arxiv.org/abs/2504.16449 · HTML: https://mlsanity.com/paper/2504.16449/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 32 of its 273 references that are in the map.
- First posted on arXiv 23 Apr 2025.

## Builds on (most cited first, 30 of 32)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Online Learning: A Comprehensive Survey](https://mlsanity.com/paper/1802.02871/) (2018)
- [URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection](https://mlsanity.com/paper/1802.03162/) (2018)
- [eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys](https://mlsanity.com/paper/1702.08568/) (2017)
- [URLTran: Improving Phishing URL Detection Using Transformers](https://mlsanity.com/paper/2106.05256/) (2021)
- [Advanced Evasion Attacks and Mitigations on Practical ML-Based Phishing Website Classifiers](https://mlsanity.com/paper/2004.06954/) (2020)
- [Malicious URL Detection using Machine Learning: A Survey](https://mlsanity.com/paper/1701.07179/) (2017)
- [Vul-LMGNNs: Fusing language models and online-distilled graph neural networks for code vulnerability detection](https://mlsanity.com/paper/2404.14719/) (2024)
- [PMANet: Malicious URL detection via post-trained language model guided multi-level feature attention network](https://mlsanity.com/paper/2311.12372/) (2023)
- [Look Before You Leap: Detecting Phishing Web Pages by Exploiting Raw URL And HTML Characteristics](https://mlsanity.com/paper/2011.04412/) (2020)
- [Toward More Generalized Malicious URL Detection Models](https://mlsanity.com/paper/2202.10027/) (2022)
- [Enhancing Unsupervised Anomaly Detection with Score-Guided Network](https://mlsanity.com/paper/2109.04684/) (2021)
- [TSGN: Transaction Subgraph Networks Assisting Phishing Detection in Ethereum](https://mlsanity.com/paper/2208.12938/) (2022)
- [Ethereum Fraud Detection via Joint Transaction Language Model and Graph Representation Learning](https://mlsanity.com/paper/2409.07494/) (2024)
- [Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning](https://mlsanity.com/paper/2210.13660/) (2022)
- [LLMs are One-Shot URL Classifiers and Explainers](https://mlsanity.com/paper/2409.14306/) (2024)
- [APOLLO: A GPT-based tool to detect phishing emails and generate explanations that warn users](https://mlsanity.com/paper/2410.07997/) (2024)
- [Using Lexical Features for Malicious URL Detection -- A Machine Learning Approach](https://mlsanity.com/paper/1910.06277/) (2019)
- [An Adversarial Attack Analysis on Malicious Advertisement URL Detection Framework](https://mlsanity.com/paper/2204.13172/) (2022)
- [TransURL: Improving malicious URL detection with multi-layer Transformer encoding and multi-scale pyramid features](https://mlsanity.com/paper/2312.00508/) (2023)
- [DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification](https://mlsanity.com/paper/2409.09143/) (2024)
- [PhishAri: Automatic Realtime Phishing Detection on Twitter](https://mlsanity.com/paper/1301.6899/) (2013)
- [Less is More: Robust and Novel Features for Malicious Domain Detection](https://mlsanity.com/paper/2006.01449/) (2020)
- [An Evasion and Counter-Evasion Study in Malicious Websites Detection](https://mlsanity.com/paper/1408.1993/) (2014)
- [Semi-supervised Conditional GAN for Simultaneous Generation and Detection of Phishing URLs: A Game theoretic Perspective](https://mlsanity.com/paper/2108.01852/) (2021)
- [Continuous Multi-Task Pre-training for Malicious URL Detection and Webpage Classification](https://mlsanity.com/paper/2402.11495/) (2024)
- [Classification of URL bitstreams using Bag of Bytes](https://mlsanity.com/paper/2111.06087/) (2021)
- [Fed-urlBERT: Client-side Lightweight Federated Transformers for URL Threat Analysis](https://mlsanity.com/paper/2312.03636/) (2023)
- [Phishing Website Detection through Multi-Model Analysis of HTML Content](https://mlsanity.com/paper/2401.04820/) (2024)

## Built on by (most cited first, 1 of 1)

- [Benchmarking Large Language Models for Zero-shot and Few-shot Phishing URL Detection](https://mlsanity.com/paper/2602.02641/) (2026)

## Abstract (arXiv)

Malicious URLs persistently threaten the cybersecurity ecosystem, by either deceiving users into divulging private data or distributing harmful payloads to infiltrate host systems. Gaining timely insights into the current state of this ongoing battle holds significant importance. However, existing reviews exhibit 4 critical gaps: 1) Their reliance on algorithm-centric taxonomies obscures understanding of how detection approaches exploit specific modal information channels; 2) They fail to incorporate pivotal LLM/Transformer-based defenses; 3) No open-source implementations are collected to facilitate benchmarking; 4) Insufficient dataset coverage.This paper presents a comprehensive review of malicious URL detection technologies, systematically analyzing methods from traditional blacklisting to advanced deep learning approaches (e.g. Transformer, GNNs, and LLMs). Unlike prior surveys, we propose a novel modality-based taxonomy that categorizes existing works according to their primary data modalities (URL, HTML, Visual, etc.). This hierarchical classification enables both rigorous technical analysis and clear understanding of multimodal information utilization. Furthermore, to establish a profile of accessible datasets and address the lack of standardized benchmarking (where current studies often lack proper baseline comparisons), we curate and analyze: 1) publicly available datasets (2016-2024), and 2) open-source implementations from published works(2013-2025). Then, we outline essential design principles and architectural frameworks for product-level implementations. The review concludes by examining emerging challenges and proposing actionable directions for future research. We maintain a GitHub repository for ongoing curating datasets and open-source implementations: https://github.com/sevenolu7/Malicious-URL-Detection-Open-Source/tree/master.