been working on a phishing link detector, the false positives were way harder than i thought

The post describes the creation of a phishing URL detection tool trained on approximately 15,000 verified phishing URLs from PhishTank. It identifies common phishing tactics including use of trusted domains (e.g., docs.google.com), URL obfuscation techniques (e.g., punycode, misleading subdomains), and look-alike domains. The detector analyzes URL text only, without visiting sites, and flags URLs with explanations. False positives were a significant challenge, requiring tuning to maintain a false alarm rate under 2%. The tool detects about 90% of phishing URLs it has not previously seen but is less effective against phishing hosted on hacked legitimate sites. The author shares the tool and methodology openly for educational purposes.

The content does not describe a specific vulnerability or active threat but rather a detection tool and its limitations. The impact is primarily educational, providing insights into phishing URL characteristics and detection challenges. There is no direct exploitation or compromise described.

No direct mitigation is required as this is not a vulnerability or active threat. The author’s tool may assist defenders in detecting phishing URLs with reasonable accuracy. Users should be aware of the limitations, especially regarding phishing on compromised legitimate domains. Blocking entire trusted domains like Google Docs is not practical, so detection must rely on more nuanced URL analysis and additional context.