PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research

• URL: http://arxiv.org/abs/2608.23199v1
• Date: Mon, 24 Aug 2026 12:50:12 GMT
• Title: PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research
• Abstract summary: Phishing websites are short-lived and rapidly changing, yet many phishing datasets reduce observations to URLs or precomputed features.<n>This study addresses this limitation with a multi-layer active-web dataset comprising 67,502 scans, including 33,387 phishing observations from operational feeds and 34,115 screened benign reference observations.<n>The corpus preserves raw evidence across HTML content and screenshots, URL and redirect behavior, HTTP and security headers, compliance files, TLS certificates, DNS and domain registration, open ports, geolocation and accessibility measurements, and network infrastructure.
• Score: 39.146761527401424
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Phishing websites are short-lived and rapidly changing, yet many phishing datasets reduce observations to URLs or precomputed features, constraining researchers to predefined representations and discarding the underlying evidence needed to derive alternative features, apply new extraction methods, examine cross-layer relationships, and reanalyze observations as phishing techniques evolve. This study addresses this limitation with a multi-layer active-web dataset comprising 67,502 scans, including 33,387 phishing observations from operational feeds and 34,115 screened benign reference observations. The corpus preserves raw evidence across HTML content and screenshots, URL and redirect behavior, HTTP and security headers, compliance files, TLS certificates, DNS and domain registration, open ports, geolocation and accessibility measurements, and network infrastructure, while explicitly recording unavailable evidence rather than treating it as negative observations. To avoid misleading infrastructure attribution on shared platforms, the study applies a hosting-aware evidence model that masks provider-owned infrastructure signals for free-hosted tenant pages while retaining meaningful page- and transport-level evidence. Characterization reveals systematic differences between phishing and benign websites across web-resource usage, domain maturity, mail and policy configuration, security headers, and infrastructure context. By preserving raw artifacts together with acquisition metadata and explicit evidence availability, the corpus provides an inspectable and reproducible foundation for future phishing measurement and dataset research.

Related papers

• A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis [0.9199488958939334]
  Phishing remains a persistent and evolving cybersecurity threat.<n>This study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse.
  arXiv  Detail & Related papers  (2026-08-17T06:23:16Z)
• Receipt Replay OOD: A Small Benchmark for Screen Replay Detection Under Domain Shift [51.56484100374058]
  We introduce Receipt Replay OOD, a small out-of-domain benchmark for screen replay detection.<n>We evaluate document replay detection models under cross-domain conditions and demonstrate the impact of domain shift on generalization performance.
  arXiv  Detail & Related papers  (2026-05-26T11:15:33Z)
• IE as Cache: Information Extraction Enhanced Agentic Reasoning [82.00741114456727]
  Information Extraction aims to distill structured, decision-relevant information from unstructured text.<n>We propose textitIE-as-Cache, a framework that repurposes IE as a cognitive cache to enhance agentic reasoning.
  arXiv  Detail & Related papers  (2026-04-16T12:18:27Z)
• TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace [0.0]
  Phishing attacks remain a persistent cybersecurity threat.<n>This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish.dk.
  arXiv  Detail & Related papers  (2026-03-23T07:30:05Z)
• WebWeaver: Structuring Web-Scale Evidence with Dynamic Outlines for Open-Ended Deep Research [73.58638285105971]
  This paper tackles textbfopen-ended deep research (OEDR), a complex challenge where AI agents must synthesize vast web-scale information into insightful reports.<n>We introduce textbfWebWeaver, a novel dual-agent framework that emulates the human research process.<n>Our framework establishes a new state-of-the-art across major OEDR benchmarks, including DeepResearch Bench, DeepConsult, and DeepResearchGym.
  arXiv  Detail & Related papers  (2025-09-16T17:57:21Z)
• Characterizing Phishing Pages by JavaScript Capabilities [77.64740286751834]
  This paper aims to aid researchers and analysts by automatically differentiating groups of phishing pages based on the underlying kit.<n>For kit detection, our system has an accuracy of 97% on a ground-truth dataset of 548 kit families deployed across 4,562 phishing URLs.<n>We find that UI interactivity and basic fingerprinting are universal techniques, present in 90% and 80% of the clusters.
  arXiv  Detail & Related papers  (2025-09-16T15:39:23Z)
• Bridging the Gap in Phishing Detection: A Comprehensive Phishing Dataset Collector [0.030786914102688596]
  This paper introduces a resource collection tool designed to gather various resources associated with a URL, such as CSS, Javascript, favicons, webpage images, and screenshots.<n>We share a sample dataset generated using our tool comprising 4,056 legitimate and 5,666 phishing URLs along with their associated resources.
  arXiv  Detail & Related papers  (2025-09-11T16:30:12Z)
• Deep Learning Models for Robust Facial Liveness Detection [56.08694048252482]
  This study introduces a robust solution through novel deep learning models addressing the deficiencies in contemporary anti-spoofing techniques.<n>By innovatively integrating texture analysis and reflective properties associated with genuine human traits, our models distinguish authentic presence from replicas with remarkable precision.
  arXiv  Detail & Related papers  (2025-08-12T17:19:20Z)
• MeAJOR Corpus: A Multi-Source Dataset for Phishing Email Detection [1.554831836850549]
  This paper presents MeAJOR, a novel, multi-source phishing email dataset.<n>It integrates 135894 samples representing a broad number of phishing tactics and legitimate emails.<n>By integrating broad features from multiple categories, our dataset provides a reusable and consistent resource.
  arXiv  Detail & Related papers  (2025-07-23T22:57:08Z)
• Can Features for Phishing URL Detection Be Trusted Across Diverse Datasets? A Case Study with Explainable AI [0.0]
  Phishing has been a prevalent cyber threat that manipulates users into revealing sensitive private information through deceptive tactics. proactively detection of phishing URLs (or websites) has been established as an widely-accepted defense approach. We analyze two publicly available phishing URL datasets, where each dataset has its own set of unique and overlapping features related to URL string and website contents.
  arXiv  Detail & Related papers  (2024-11-14T21:07:52Z)
• Black-box Dataset Ownership Verification via Backdoor Watermarking [67.69308278379957]
  We formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model. We propose to embed external patterns via backdoor watermarking for the ownership verification to protect them. Specifically, we exploit poison-only backdoor attacks ($e.g.$, BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification.
  arXiv  Detail & Related papers  (2022-08-04T05:32:20Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.