The problem
Phishing links reach people through channels that have no filtering at all. A classifier that runs on the URL alone, with no page fetch, can give a useful signal before anyone clicks.
What I built
Features are lexical and structural: length, entropy, subdomain depth, presence of an IP literal, suspicious token counts and TLD reputation. No page is fetched, which keeps it fast and keeps the tool from becoming a way to trigger the payload.
The model was evaluated on precision at high recall rather than raw accuracy, because a phishing detector that misses attacks is worse than one that occasionally over-flags.
Architecture
scikit-learn for the model and evaluation, Pandas for the dataset work, and a small Python interface for scoring a URL on demand.
Problems worth writing down
Class imbalance
Legitimate URLs vastly outnumber phishing ones. Stratified splits and class weighting stopped the model from getting a good score by always guessing safe.
Feature leakage
An early feature encoded the dataset source and inflated the score. Removing it dropped accuracy and made the number honest.