A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Unai Agirre; Imanol Jerico; Felipe Castaño; Andrea Venturi; Francesco Zola

cs.LGAug 17, 2026

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Authors: Unai Agirre, Imanol Jerico, Felipe Castaño, Andrea Venturi, Francesco Zola

Organizations: Digital Security Department, Vicomtech (BRTA), Donostia / San Sebastian, Spain · University of Le´on, Le´on, Spain

Abstract

Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats

Figures & tables

Fig. 1 : Example of a tree extracted from an HTML DOM.

	Features	Description
1	Number of nodes	It represents the total count of HTML elements within the pruned DOM tree, indicating the overall structural complexity of the web page.
2	Number of edges	It quantifies the total hierarchical and relational links between elements. A high edge-to-node ratio often suggests a more complex layout.
3	Maximum centrality	It identifies the most interconnected node in the graph. In phishing, this often corresponds to a central container or a critical form element [ 22 ] .
4	Minimum centrality	It measures the lowest degree of connectivity, helping to identify peripheral elements or isolated scripts often used for obfuscation [ 22 ] .
5	Centrality on average	This feature provides a global measure of structural importance across all elements, capturing the general density of the page’s architecture [ 23 ] .

TABLE I : List of structural properties extracted from the tree.

Fig. 2 : Schema of the qualitative validation steps followed during the analysis.

Algorithms	Parameter	Values
DBSCAN	$\epsilon$	{0.1, 0.2,…, 1.0}, step=0.1
DBSCAN	min_samples	2, 3, 5, 8, 10
OPTICS	$xi$	{0.1, 0.2,…, 1.0}, step=0.1
OPTICS	min_samples	2, 3, 5, 8, 10
AHC	$t$	5, 25, 50, 75, 100

TABLE II : Grid search parameters for clustering algorithms.

Panel of Figure 5 — Fig. 3 : DBSCAN $\mathcal{S}_{score}$ during the grid-search using only structural features.

Panel of Figure 6 — Fig. 4 : OPTICS $\mathcal{S}_{score}$ during the grid-search using only structural features.

Fig. 5 : AHC $\mathcal{S}_{score}$ during the grid-search using only structural features.

TABLE III : Metrics of the best configuration of each algorithms for each level.

N_{c}

indicates the number of generated clusters;

N_{o\%}

the number of samples in percentage clustered as noisy points;

S_{i\%}

the number of cluster in percentage that have only one sample within. For each metric and each algorithm, the best metric value is shown in bold, while the model selected as the best performer is highlighted in yellow.

Algorithms	Features	Parameters	Level	$\mathcal{LJD}_{mean}$	$\mathcal{LJD}_{std}$	$\mathcal{LJD}_{max}$	# Cluster with $\mathcal{LJD(C)}=0$
DBSCAN	structural	$\epsilon=0.6$ , min_samples = 10	14	0.903	0.052	0.963	0
DBSCAN	structural + content	$\epsilon=0.9$ , min_samples = 2	8	0.158	0.254	0.979	133
OPTICS	structural	$xi=0.1$ , min_samples = 2	11	0.592	0.368	1.093	87
OPTICS	structural + content	$xi=0.3$ , min_samples = 2	8	0.242	0.305	1.088	170
AHC	structural	$t=75.0$	14	0.901	0.047	0.959	0
AHC	structural + content	$t=5.0$	15	0.351	0.335	1.036	55

TABLE IV : Best configuration for each algorithm using structural and content-based information, and the corresponding results obtained during quantitative validation. In bold the best values in each case.

Panel of Figure 10 — Fig. 6 : Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural based features. Changes are marked with a black circle.

Panel of Figure 11 — Fig. 7 : Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural and content-based features. Changes are marked with a black circle.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Fig. 8 : AHC $\mathcal{S}_{score}$ during the grid-search using structural and content-based features.

Panel of Figure 13 — Fig. 9 : DBSCAN $\mathcal{S}_{score}$ during the grid-search using structural and content-based features.

Panel of Figure 14 — Fig. 10 : OPTICS $\mathcal{S}_{score}$ during the grid-search using structural and content-based features.

Panel of Figure 15 — Fig. 11 : Qualitative analysis: - medoids of $N$ dispersed clusters.

Unsupervised Clustering

Unsupervised clustering groups unlabeled data by similarity or structure to reveal patterns, subgroups, and anomalies.

See all 117 papers

Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection
Mar 2, 2026Tailai Song, Pedro Casas, Michela MeoPhishing Detection Graph Neural Networks
Politecnico di Torino Turin, Italy · AIT Austrian Institute of Technology Vienna, Austria
TraceScope: Interactive URL Triage via Decoupled Checklist Adjudication
Apr 23, 2026Haolin Zhang, William Reber, Yuxuan Zhang +2Digital Forensics Phishing Detection
Texas A&M University
A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features
May 30, 2026Uche Unoke Emmanuel, Gideon Francis OghieMultilayer Perceptrons Phishing Detection
Department of Cyber Security Science, School of Information and Communication Technology, Federal University of Technology, Minna, Nigeria

Mar 2, 2026J/K move · Enter open · S save

Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection

Tailai Song, Pedro Casas, Michela Meo

Politecnico di Torino Turin, Italy · AIT Austrian Institute of Technology Vienna, Austria

Phishing Detection Graph Neural Networks

Open paper AskPDF arXiv

Phishing remains the most pervasive threat to the Web, enabling large-scale credential theft and financial fraud through deceptive webpages. While recent reference-based and generative-AI-driven phishing detectors achieve strong accuracy, their reliance on external knowledge bases, cloud services, and complex multimodal pipelines fundamentally limits practicality, scalability, and reproducibility. In contrast, conventional deep learning approaches often fail to generalize to evolving phishing campaigns. We introduce SpecularNet, a novel lightweight framework for reference-free web phishing detection that demonstrates how carefully designed compact architectures can rival heavyweight systems. SpecularNet operates solely on the domain name and HTML structure, modeling the Document Object Model (DOM) as a tree and leveraging a hierarchical graph autoencoding architecture with directional, level-wise message passing. This design captures higher-order structural invariants of phishing webpages while enabling fast, end-to-end inference on standard CPUs. Extensive evaluation against 13 state of the art phishing detectors, including leading reference-based systems, shows that SpecularNet achieves competitive detection performance with dramatically lower computational cost. On benchmark datasets, it reaches an F1 score of 93.9%, trailing the best reference-based method slightly while reducing inference time from several seconds to approximately 20 milliseconds per webpage. Field and robustness evaluations further validate SpecularNet in real-world deployments, on a newly collected 2026 open-world dataset, and against adversarial attacks.

Abstract

Unsupervised Clustering

Explore similar work

Phishing the Phishers with SpecularNet: Hierarchical Graph Autoencoding for Reference-Free Web Phishing Detection

TraceScope: Interactive URL Triage via Decoupled Checklist Adjudication

A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features