Real-Time Phishing URL Detection Using Gated Recurrent Units and Character-Level Embedding

Phishing attacks remain a major threat to internet users since attackers use human trust and misleading URLs to capture sensitive information. Real-time phishing URL detection has become an essential area of focus in cybersecurity, protecting users from malicious web content. Nevertheless, current approaches tend to be highly dependent on blocklists or manually created features, which fail to keep pace with the rapidly evolving tactics of phishing websites. These classical methods are non-generalizable and non-adaptive to unknown or slightly altered phishing URLs. In response to these shortcomings, this paper presents GRU-CLIP (Gated Recurrent Unit with Character-Level Input for Phishing Detection)—a live browser extension system for phishing URL detection. The method employs character-level embeddings to learn fine-grained patterns and a GRU network, which captures sequential dependencies and contextual relationships between characters, allowing for the exact detection of malicious URLs without the use of manually engineered features or prior knowledge. The GRU-CLIP framework is intended to be natively integrable as a browser extension, providing real-time detection and user notification with minimal latency. It checks URLs upon hoverover or click on links, providing a strong and timely phishing defense mechanism. Experimental results demonstrate that GRU-CLIP achieves high detection accuracy and recall, outperforming conventional machine learning methods in identifying both known and zero-day phishing URLs. This approach enhances proactive phishing threat protection and offers a scalable and adaptive solution suitable for contemporary web usage scenarios.