A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis
2026-08-17 • Machine Learning
Machine LearningArtificial IntelligenceEmerging Technologies
AI summaryⓘ
The authors studied how phishing websites often share hidden similarities in their structure because they use common templates. They looked at the websites as tree-like structures (DOM trees) and used computer algorithms to group similar pages together without needing prior examples. Their approach helps find new or coordinated phishing attacks by spotting these structural patterns rather than just looking at obvious features. This method could improve how phishing sites are detected early on.
PhishingPhishing kitsHTMLDOM treeUnsupervised learningClustering algorithmsCybersecurityJaccard DistanceZero-day threatsWebpage structure
Authors
Unai Agirre, Imanol Jerico, Felipe Castaño, Andrea Venturi, Francesco Zola
Abstract
Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats