Marchal, Saari, Singh and Asokan (ICDCS 2016) built a phishing-webpage classifier whose advertised strength is language independence: it computes distributions of 'terms' — substrings over the 26 lowercase English letters, obtained by canonicalizing accents and splitting at every non-English-alphabet character — over a page's URL, domain name, links, text and the optical character recognition (OCR) output of its screenshot, and compares them with lexical-consistency features. It was evaluated only on six Latin-script European languages, and the authors conjectured that pages written in other alphabets, in particular pages whose content is in one alphabet and URL in another, may be misclassified. No published work evaluates term-based language-independent phishing webpage detectors on non-Latin-script (e.g., Cyrillic, Arabic, Chinese) webpages; the six-European-language evaluation has not been extended to other scripts; adjacent lines (IDN-homograph attack detection, per-language detectors and corpora, character-level URL models, vision-based identification) address different problems; and a 2025 peer-reviewed study on minor Latin-script European languages states that performance on Cyrillic, Arabic and Chinese scripts 'remains unverified'. The problem is to construct labeled non-Latin-script phishing and legitimate webpage datasets, measure and explain cross-script degradation (including the conjectured empty-term-distribution and mixed-alphabet failure modes), and determine whether and how term extraction can be reformulated so that language independence extends across writing systems.

Background

Phishing is the attack in which a victim is lured to a fake webpage imitating a legitimate site (a bank, a mail provider, an e-commerce brand) and tricked into disclosing credentials or personal data. Defenses include blacklists such as PhishTank, which lag new attacks because phishing pages live only hours to days, and machine-learning classifiers that decide from features of the URL, the page content, and the hosting infrastructure. Most feature designs (bag-of-words, term frequency-inverse document frequency) are language-dependent: they learn the specific words of the training corpus, which biases them toward the language and brands seen in training. Marchal, Saari, Singh and Asokan (ICDCS 2016) instead proposed a language- and brand-independent webpage classifier suited to client-side deployment. It represents a webpage by 'term distributions': a term is any substring of length at least three over the 26 lowercase English letters, obtained by canonicalizing upper-case and accented characters to base letters and splitting the string at every character outside that alphabet; the resulting term frequency distributions are computed separately for fourteen data sources of a page (body text, title, copyright notice, terms recognized by optical character recognition on the page screenshot, the free part and the registered domain part of the starting and landing URLs, and internal and external links). The detector's 212 features comprise 106 URL lexical-statistic features, 66 term-usage-consistency features and 40 further features in three smaller groups. The 66 consistency features are pairwise Hellinger distances between twelve of the fourteen term distributions (the copyright-notice and OCR-image distributions are excluded from these comparisons) and measure how consistent term usage is across sources that the page owner controls freely versus sources constrained by domain registration or outside the owner's control, on the conjecture that phishers cannot make a fake page term-consistent everywhere. A gradient boosting model over these features reached over 99% accuracy with under 0.1% false positives. Its 'language independence' was validated on webpages in six European languages — English, French, German, Italian, Portuguese, Spanish — all of which use the Latin alphabet. The paper's limitations section notes two structural warning signs: on phishing URLs that use a raw IP address instead of a domain name, the domain-based term distributions are empty and recall dropped to 0.76 (19 of 25 such URLs); and, verbatim, 'webpages whose content is in one alphabet and URL in another may be misclassified. So far we have only tested webpages in European languages. Classifier performance on pages in other languages may be lower.' Since the term-extraction rule deletes every character outside the English alphabet, a page written in Cyrillic, Arabic or Chinese yields empty or near-empty term distributions for its textual sources — the same degradation mechanism observed for IP-based URLs — while a mixed-alphabet page (for example, a Latin-alphabet domain serving Arabic content) produces source distributions that cannot be compared consistently. The same authors later restated the issue as an evaluation-methodology gap for the whole field of lexical phishing detection (CSET @ USENIX Security 2018), pointing out that about half of web content is non-English (roughly 6% Russian, 4% Japanese per the web-content statistics they cite) and that evaluating only on the Roman alphabet does not assess efficacy on Chinese, Japanese or Cyrillic pages. Related but distinct threads exist on the attacker side: internationalized domain names (IDN) allow Unicode in domain names, and 'homograph' attacks exploit visually identical characters across scripts (e.g., Latin 'a' versus Cyrillic 'а') to build lookalike domains, a problem addressed by dedicated detectors; that literature studies script confusion as an attack tool, not the cross-script generalization of content-based detectors.

Problem Statement

Determine whether language-independent, term-distribution-based phishing webpage detection generalizes from the Latin alphabet to webpages written in other scripts. Concretely: (1) construct labeled datasets of phishing and legitimate webpages written in non-Latin scripts — at minimum the Chinese, Japanese and Cyrillic cases named by Marchal and Asokan (CSET @ USENIX Security 2018) and the Arabic case named by Komosny (2025) — with documented label provenance and verified language/script composition, since the literature identifies the absence of such datasets as the blocking prerequisite; (2) measure the performance of the term-distribution classifier family (Marchal et al.'s 212-feature set, including the 66 term-usage-consistency features, with their English-alphabet term extraction and gradient boosting model) on these datasets against the Latin-script baseline, reporting accuracy, recall and false-positive rate per script, and test the two conjectured failure modes: empty or degenerate term distributions caused by discarding all non-Latin characters (the mechanism behind the measured recall drop to 0.76 on IP-based URLs), and misclassification of pages whose content and URL use different alphabets; (3) attribute the degradation to specific features and decision paths, controlling for confounds such as site popularity, brand mix and class balance; and (4) if degradation is confirmed, investigate on the basis of that diagnosis whether and how term extraction can be redesigned to be script-agnostic while remaining applicable to unsegmented scripts such as Chinese, and evaluate any redesign on the same datasets against the Latin-script baseline measured in (2), reporting accuracy, recall and false-positive rate per script, so as to establish whether language independence can be extended to script independence without losing the accuracy and low false-positive rate that motivate the approach. The dataset construction, measurement, failure-mode attribution and remediation investigation jointly serve one overarching objective: establishing whether, and under what conditions, language-independent phishing webpage detection is script-independent. If the measurements in (2) confirm degradation, (3) explains the measured degradation and (4) establishes whether and how term extraction can be made script-agnostic.

References

  1. Samuel Marchal, Kalle Saari, Nidhi Singh, N. Asokan. Know Your Phish: Novel Techniques for Detecting Phishing Sites and Their Targets. 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), pp. 323-333. DOI 10.1109/ICDCS.2016.10. https://doi.org/10.1109/ICDCS.2016.10
  2. Samuel Marchal, Giovanni Armano, Tommi Grondahl, Kalle Saari, Nidhi Singh, N. Asokan. Off-the-Hook: An Efficient and Usable Client-Side Phishing Prevention Application. IEEE Transactions on Computers, 2017. DOI 10.1109/TC.2017.2703808. https://doi.org/10.1109/TC.2017.2703808
  3. Samuel Marchal, N. Asokan. On Designing and Evaluating Phishing Webpage Detection Techniques for the Real World. CSET @ USENIX Security Symposium, 2018. https://www.usenix.org/conference/cset18/presentation/marchal
  4. Jehyun Lee, Pingxiao Ye, Ruofan Liu, Dinil Mon Divakaran, Mun Choon Chan. Building Robust Phishing Detection System: an Empirical Analysis. MADWeb '20 (Workshop on Measurements and Attacks on the Web), 2020. DOI 10.14722/madweb.2020.23007. https://doi.org/10.14722/madweb.2020.23007
  5. Jonathan Woodbridge, Hyrum S. Anderson, Anjum Ahuja, Daniel Grant. Detecting Homoglyph Attacks with a Siamese Neural Network. 2018 IEEE Security and Privacy Workshops (SPW). DOI 10.1109/SPW.2018.00012. https://doi.org/10.1109/SPW.2018.00012
  6. Hiroaki Suzuki, Daiki Chiba, Yoshiro Yoneya, Tatsuya Mori, Shigeki Goto. ShamFinder: An Automated Framework for Detecting IDN Homographs. arXiv:1909.07539, 2019. https://arxiv.org/abs/1909.07539
  7. Ramin Yazdani, Olivier van der Toorn, Anna Sperotto. A Case of Identity: Detection of Suspicious IDN Homograph Domains Using Active DNS Measurements. 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). DOI 10.1109/EuroSPW51379.2020.00082. https://doi.org/10.1109/EuroSPW51379.2020.00082
  8. Ali Aljofey, Qingshan Jiang, Qiang Qu, Mingqing Huang, Jean-Pierre Niyigena. An Effective Phishing Detection Model Based on Character Level Convolutional Neural Network from URL. Electronics 9(9):1514, 2020. DOI 10.3390/electronics9091514. https://doi.org/10.3390/electronics9091514
  9. Yun Lin, Ruofan Liu, Dinil Mon Divakaran, Jun Yang Ng, Qing Zhou Chan, Yiwen Lu, Yuxuan Si, Fan Zhang, Jin Song Dong. Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages. 30th USENIX Security Symposium (USENIX Security 21), 2021. https://www.usenix.org/conference/usenixsecurity21/presentation/lin
  10. Ceylan Bozogullarindan, Celal Ozturk. Detection of Turkish Fraudulent Domain Names to Proactively Prevent Phishing Attacks Using A Character-Level Convolutional Neural Network. 2023 Innovations in Intelligent Systems and Applications Conference (ASYU). DOI 10.1109/ASYU58738.2023.10296643. https://doi.org/10.1109/ASYU58738.2023.10296643
  11. Said Salloum, Tarek Gaber, Sunil Vadera, Khaled Shaalan. A New English/Arabic Parallel Corpus for Phishing Emails. ACM Transactions on Asian and Low-Resource Language Information Processing 22(7):1-17, 2023. DOI 10.1145/3606031. https://doi.org/10.1145/3606031
  12. Dan Komosny. Phishing detection on webpages in European non-English languages based on machine learning. Scientific Reports, 2025. DOI 10.1038/s41598-025-21384-w. https://doi.org/10.1038/s41598-025-21384-w
  13. Panharith An, Rana Shafi, Tionge Mughogho, Onyango Allan Onyango. Multilingual Email Phishing Attacks Detection using OSINT and Machine Learning. arXiv:2501.08723, 2025. https://arxiv.org/abs/2501.08723
  14. Sena Apeke, Titembaye Djiraikinan, Mohamed Barate. Phishing detection by Transformers: Adversarial Robustness and Cross-Lingual Generalization. Indian Journal of Science and Technology 19(12):851-860, 2026. DOI 10.17485/ijst/v19i12.51. https://doi.org/10.17485/ijst/v19i12.51
  15. Sam Nguyen-Xuan, Han Nguyen, Giap Dang Le, Daehee Kim. A Mixed-Language Transformer Encoder Architecture for Social Media Phishing: Vietnamese-English Case Study. IEEE Access 14:75563-75576, 2026. DOI 10.1109/ACCESS.2026.3694267. https://doi.org/10.1109/ACCESS.2026.3694267