Modified Phishing Website Detection.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Phishing Website Detection "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Step -1 : Data preprocessing \n",
    "\n",
    "This dataset contains few website links (Some of them are legitimate websites and a few are fake websites)\n",
    "\n",
    "Pre-Processing the data before building a model and also Extracting the features from the data based on certain conditions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {},
   "outputs": [],
   "source": [
    "#importing numpy and pandas which are required for data pre-processing\n",
    "import numpy as np\n",
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [],
   "source": [
    "#Loading the data\n",
    "raw_data = pd.read_csv(\"dataset2.csv\") "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>URL</th>\n",
       "      <th>Target</th>\n",
       "      <th>Unnamed: 2</th>\n",
       "      <th>Unnamed: 3</th>\n",
       "      <th>Unnamed: 4</th>\n",
       "      <th>Unnamed: 5</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https://locking-app-adverds.000webhostapp.com/...</td>\n",
       "      <td>yes</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http://www.myhealthcarepharmacy.ca/wp-includes...</td>\n",
       "      <td>yes</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http://code.google.com/p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http://linkedin.com/</td>\n",
       "      <td>no</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http://imageshack.com/f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                                 URL Target  Unnamed: 2  \\\n",
       "0  https://locking-app-adverds.000webhostapp.com/...    yes         NaN   \n",
       "1  http://www.myhealthcarepharmacy.ca/wp-includes...    yes         NaN   \n",
       "2            http://code.google.com/p/pylevenshtein/     no         NaN   \n",
       "3                               http://linkedin.com/     no         NaN   \n",
       "4          http://imageshack.com/f/219/cadir2yr3.jpg     no         NaN   \n",
       "\n",
       "   Unnamed: 3  Unnamed: 4  Unnamed: 5  \n",
       "0         NaN         NaN         NaN  \n",
       "1         NaN         NaN         NaN  \n",
       "2         NaN         NaN         NaN  \n",
       "3         NaN         NaN         NaN  \n",
       "4         NaN         NaN         NaN  "
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "raw_data.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We need to split the data according to parts of the URL\n",
    "\n",
    "A typical URL could have the form http://www.example.com/index.html, which indicates a protocol (http), a hostname (www.example.com), and a file name (index.html)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0    [https, locking-app-adverds.000webhostapp.com/...\n",
       "1    [http, www.myhealthcarepharmacy.ca/wp-includes...\n",
       "2             [http, code.google.com/p/pylevenshtein/]\n",
       "3                                [http, linkedin.com/]\n",
       "4           [http, imageshack.com/f/219/cadir2yr3.jpg]\n",
       "Name: URL, dtype: object"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "raw_data['URL'].str.split(\"://\").head() #Here we divided the protocol from the entire URL. but need it to be divided it \n",
    "                                                 #seperate column"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "seperation_of_protocol = raw_data['URL'].str.split(\"://\",expand = True) #expand argument in the split method will give you a new column"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>0</th>\n",
       "      <th>1</th>\n",
       "      <th>2</th>\n",
       "      <th>3</th>\n",
       "      <th>4</th>\n",
       "      <th>5</th>\n",
       "      <th>6</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com/payment-...</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca/wp-includes/js/jqu...</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com/p/pylevenshtein/</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com/</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com/f/219/cadir2yr3.jpg</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       0                                                  1     2     3     4  \\\n",
       "0  https  locking-app-adverds.000webhostapp.com/payment-...  None  None  None   \n",
       "1   http  www.myhealthcarepharmacy.ca/wp-includes/js/jqu...  None  None  None   \n",
       "2   http                   code.google.com/p/pylevenshtein/  None  None  None   \n",
       "3   http                                      linkedin.com/  None  None  None   \n",
       "4   http                 imageshack.com/f/219/cadir2yr3.jpg  None  None  None   \n",
       "\n",
       "      5     6  \n",
       "0  None  None  \n",
       "1  None  None  \n",
       "2  None  None  \n",
       "3  None  None  \n",
       "4  None  None  "
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "seperation_of_protocol.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "pandas.core.frame.DataFrame"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "type(seperation_of_protocol)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "seperation_domain_name = seperation_of_protocol[1].str.split(\"/\",1,expand = True) #split(seperator,no of splits according to seperator(delimiter),expand)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "pandas.core.frame.DataFrame"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "type(seperation_domain_name)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "seperation_domain_name.columns=[\"domain_name\",\"address\"] #renaming columns of data frame"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                             domain_name  \\\n",
       "0  locking-app-adverds.000webhostapp.com   \n",
       "1            www.myhealthcarepharmacy.ca   \n",
       "2                        code.google.com   \n",
       "3                           linkedin.com   \n",
       "4                         imageshack.com   \n",
       "\n",
       "                                             address  \n",
       "0  payment-update-0.html?fb_source=bookmark_apps&...  \n",
       "1                      wp-includes/js/jquery/ini.php  \n",
       "2                                   p/pylevenshtein/  \n",
       "3                                                     \n",
       "4                                f/219/cadir2yr3.jpg  "
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "seperation_domain_name.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [],
   "source": [
    "#Concatenation of data frames\n",
    "splitted_data = pd.concat([seperation_of_protocol[0],seperation_domain_name],axis=1)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data.columns = ['protocol','domain_name','address']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  protocol                            domain_name  \\\n",
       "0    https  locking-app-adverds.000webhostapp.com   \n",
       "1     http            www.myhealthcarepharmacy.ca   \n",
       "2     http                        code.google.com   \n",
       "3     http                           linkedin.com   \n",
       "4     http                         imageshack.com   \n",
       "\n",
       "                                             address  \n",
       "0  payment-update-0.html?fb_source=bookmark_apps&...  \n",
       "1                      wp-includes/js/jquery/ini.php  \n",
       "2                                   p/pylevenshtein/  \n",
       "3                                                     \n",
       "4                                f/219/cadir2yr3.jpg  "
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data['is_phished'] = pd.Series(raw_data['Target'], index=splitted_data.index)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>https</td>\n",
       "      <td>doc-08-bc-apps-viewer.googleusercontent.com</td>\n",
       "      <td>viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>http</td>\n",
       "      <td>www.7-zip.org</td>\n",
       "      <td>download.html</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>http</td>\n",
       "      <td>ebay.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>https</td>\n",
       "      <td>login.yahoo.com</td>\n",
       "      <td>config/login?.done=https%3a%2f%2fapi.login.yah...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gulfshield.com</td>\n",
       "      <td>uploads/gallery/mankind/secure/fiscal/manual/m...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>http</td>\n",
       "      <td>rodritol.com</td>\n",
       "      <td>components/kttm/dropbox/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>https</td>\n",
       "      <td>ecommerce-platforms.com</td>\n",
       "      <td>articles/top-6-ecommerce-platform-reviews-2012...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>https</td>\n",
       "      <td>evercoin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>http</td>\n",
       "      <td>www.phishtank.com</td>\n",
       "      <td>phish_archive.php</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>http</td>\n",
       "      <td>mawar-abdrahim.co.id</td>\n",
       "      <td>kip/spacebox/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>http</td>\n",
       "      <td>jovan.soldatovic.org</td>\n",
       "      <td>css/google-manual/f6946ab165caf661256632b7502e...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>http</td>\n",
       "      <td>www.telesport-tv.com.ar</td>\n",
       "      <td>media/index.htm</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>http</td>\n",
       "      <td>pixelpicturescorp.com</td>\n",
       "      <td></td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>http</td>\n",
       "      <td>puertovarasflyfishing.com</td>\n",
       "      <td>chas</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ortakhatim.com</td>\n",
       "      <td>mukabele/106_107.htm</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>http</td>\n",
       "      <td>les-avertis.net</td>\n",
       "      <td>mlec/mlec.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>http</td>\n",
       "      <td>www.rileysbrandhoney.com</td>\n",
       "      <td>online/asb/asb.co.nz/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>http</td>\n",
       "      <td>girlsneedhelp.info</td>\n",
       "      <td>docss/file/files/db/file.dropbox/form.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>http</td>\n",
       "      <td>netflix.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/5739e346002526519df9d8623b9c854b/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>https</td>\n",
       "      <td>commons.wikimedia.org</td>\n",
       "      <td>wiki/commons:wiki_loves_monuments_2017_in_the_...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>https</td>\n",
       "      <td>jobs.jobvite.com</td>\n",
       "      <td>careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>http</td>\n",
       "      <td>log-upgrade-helpdata-isetting-data-us.akunnet.com</td>\n",
       "      <td>up/verification/7na1n7878n0b27m71d15/qes.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>http</td>\n",
       "      <td>ovodfurnituremakers.com</td>\n",
       "      <td>wp-yahoo/t/y1.html</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1751</th>\n",
       "      <td>http</td>\n",
       "      <td>mvpl.enkilibrary.org</td>\n",
       "      <td>myresearch/home</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1752</th>\n",
       "      <td>http</td>\n",
       "      <td>www.techrepublic.com</td>\n",
       "      <td>article/deceptive-networking-lures-hackers-wit...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1753</th>\n",
       "      <td>http</td>\n",
       "      <td>naleoserver.3disystems.com</td>\n",
       "      <td>drupal/sites/default/files/ub/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1754</th>\n",
       "      <td>https</td>\n",
       "      <td>app-1506806908.000webhostapp.com</td>\n",
       "      <td>public/revery/revery/card.html?wo9spdzhykzcx2h...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1755</th>\n",
       "      <td>http</td>\n",
       "      <td>stephanehamard.com</td>\n",
       "      <td>components/com_joomlastats/fr/b69d7d0348bc9799...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1756</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/9bd4c1dm321n45805n9...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1757</th>\n",
       "      <td>http</td>\n",
       "      <td>kampanya.qnbfinansbank.com</td>\n",
       "      <td>asp/scrunsubscribe.aspx?cmdmkey=404433025&amp;emai...</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1758</th>\n",
       "      <td>https</td>\n",
       "      <td>apps.shopify.com</td>\n",
       "      <td>shopify-recurring-payments</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1759</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1760</th>\n",
       "      <td>http</td>\n",
       "      <td>chairnerd.seatgeek.com</td>\n",
       "      <td>fuzzywuzzy-fuzzy-string-matching-in-python/</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1761</th>\n",
       "      <td>http</td>\n",
       "      <td>www.sozce.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1762</th>\n",
       "      <td>http</td>\n",
       "      <td>snackenak.co.id</td>\n",
       "      <td>secure-domains/document/pvalidate.html</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1763</th>\n",
       "      <td>http</td>\n",
       "      <td>www.hbo.com</td>\n",
       "      <td>silicon-valley/episodes</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1764</th>\n",
       "      <td>http</td>\n",
       "      <td>www.bbc.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1765</th>\n",
       "      <td>http</td>\n",
       "      <td>gu.com</td>\n",
       "      <td>p/76dxv?cmp=share_androidapp_facebook</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1766</th>\n",
       "      <td>http</td>\n",
       "      <td>malomolk.com</td>\n",
       "      <td>nab/cardinfo.html</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1767</th>\n",
       "      <td>https</td>\n",
       "      <td>goodlogstext4004.000webhostapp.com</td>\n",
       "      <td>recovery-answer.html?=10065877425?fb_source=bo...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1768</th>\n",
       "      <td>http</td>\n",
       "      <td>particuliers.secure.credit-agricole.fr.mtoffic...</td>\n",
       "      <td>stb/entreebam/informations-requises.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1769</th>\n",
       "      <td>http</td>\n",
       "      <td>confrecor.org</td>\n",
       "      <td>successs/ssdsss/filessss/filessss/documentss/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1770</th>\n",
       "      <td>http</td>\n",
       "      <td>eltonjohncover.com.br</td>\n",
       "      <td>ftm/ghost/30055bc987091413d1307854d418711f/</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1771</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gettingpaidtopayattention.com</td>\n",
       "      <td>dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1772</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-01.html?fb_source=bookmark_apps...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1773</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/baa9b99a51bd58d62d3...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1774</th>\n",
       "      <td>http</td>\n",
       "      <td>www.dpincsupport.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1775</th>\n",
       "      <td>https</td>\n",
       "      <td>bitcoin.org</td>\n",
       "      <td>en/</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1776</th>\n",
       "      <td>https</td>\n",
       "      <td>docs.google.com</td>\n",
       "      <td>document/u/1/</td>\n",
       "      <td>no</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1777</th>\n",
       "      <td>http</td>\n",
       "      <td>www.charlestodd.com</td>\n",
       "      <td>wp-includes/pomo/adobe2.html</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1778</th>\n",
       "      <td>http</td>\n",
       "      <td>tslimpact.com</td>\n",
       "      <td>medsynaptic/wp-content/themes/twentyseventeen/...</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1779</th>\n",
       "      <td>http</td>\n",
       "      <td>daoudilorin11.mystagingwebsite.com</td>\n",
       "      <td>wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1780</th>\n",
       "      <td>https</td>\n",
       "      <td>stom05.ru</td>\n",
       "      <td>asb.co.nz</td>\n",
       "      <td>yes</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1781 rows × 4 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     protocol                                        domain_name  \\\n",
       "0       https              locking-app-adverds.000webhostapp.com   \n",
       "1        http                        www.myhealthcarepharmacy.ca   \n",
       "2        http                                    code.google.com   \n",
       "3        http                                       linkedin.com   \n",
       "4        http                                     imageshack.com   \n",
       "5       https        doc-08-bc-apps-viewer.googleusercontent.com   \n",
       "6        http                                      www.7-zip.org   \n",
       "7        http                                           ebay.com   \n",
       "8       https                                    login.yahoo.com   \n",
       "9        http                            mobile-free.metulwx.com   \n",
       "10      https                                 www.gulfshield.com   \n",
       "11       http                                       rodritol.com   \n",
       "12      https                            ecommerce-platforms.com   \n",
       "13      https                                       evercoin.com   \n",
       "14       http                                  www.phishtank.com   \n",
       "15       http                               mawar-abdrahim.co.id   \n",
       "16       http                               jovan.soldatovic.org   \n",
       "17       http                            www.telesport-tv.com.ar   \n",
       "18       http                              pixelpicturescorp.com   \n",
       "19       http                          puertovarasflyfishing.com   \n",
       "20       http                                 www.ortakhatim.com   \n",
       "21       http                                    les-avertis.net   \n",
       "22       http                           www.rileysbrandhoney.com   \n",
       "23       http                                 girlsneedhelp.info   \n",
       "24       http                                        netflix.com   \n",
       "25       http                            mobile-free.metulwx.com   \n",
       "26      https                              commons.wikimedia.org   \n",
       "27      https                                   jobs.jobvite.com   \n",
       "28       http  log-upgrade-helpdata-isetting-data-us.akunnet.com   \n",
       "29       http                            ovodfurnituremakers.com   \n",
       "...       ...                                                ...   \n",
       "1751     http                               mvpl.enkilibrary.org   \n",
       "1752     http                               www.techrepublic.com   \n",
       "1753     http                         naleoserver.3disystems.com   \n",
       "1754    https                   app-1506806908.000webhostapp.com   \n",
       "1755     http                                 stephanehamard.com   \n",
       "1756     http                          www.scuolasci-dolomiti.it   \n",
       "1757     http                         kampanya.qnbfinansbank.com   \n",
       "1758    https                                   apps.shopify.com   \n",
       "1759      NaN                                                NaN   \n",
       "1760     http                             chairnerd.seatgeek.com   \n",
       "1761     http                                      www.sozce.com   \n",
       "1762     http                                    snackenak.co.id   \n",
       "1763     http                                        www.hbo.com   \n",
       "1764     http                                        www.bbc.com   \n",
       "1765     http                                             gu.com   \n",
       "1766     http                                       malomolk.com   \n",
       "1767    https                 goodlogstext4004.000webhostapp.com   \n",
       "1768     http  particuliers.secure.credit-agricole.fr.mtoffic...   \n",
       "1769     http                                      confrecor.org   \n",
       "1770     http                              eltonjohncover.com.br   \n",
       "1771    https                  www.gettingpaidtopayattention.com   \n",
       "1772    https              locking-app-adverds.000webhostapp.com   \n",
       "1773     http                          www.scuolasci-dolomiti.it   \n",
       "1774     http                               www.dpincsupport.com   \n",
       "1775    https                                        bitcoin.org   \n",
       "1776    https                                    docs.google.com   \n",
       "1777     http                                www.charlestodd.com   \n",
       "1778     http                                      tslimpact.com   \n",
       "1779     http                 daoudilorin11.mystagingwebsite.com   \n",
       "1780    https                                          stom05.ru   \n",
       "\n",
       "                                                address is_phished  \n",
       "0     payment-update-0.html?fb_source=bookmark_apps&...        yes  \n",
       "1                         wp-includes/js/jquery/ini.php        yes  \n",
       "2                                      p/pylevenshtein/         no  \n",
       "3                                                               no  \n",
       "4                                   f/219/cadir2yr3.jpg         no  \n",
       "5     viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...         no  \n",
       "6                                         download.html         no  \n",
       "7                                                               no  \n",
       "8     config/login?.done=https%3a%2f%2fapi.login.yah...         no  \n",
       "9                                        mobile/impaye/        yes  \n",
       "10    uploads/gallery/mankind/secure/fiscal/manual/m...        yes  \n",
       "11                             components/kttm/dropbox/        yes  \n",
       "12    articles/top-6-ecommerce-platform-reviews-2012...         no  \n",
       "13                                                              no  \n",
       "14                                    phish_archive.php         no  \n",
       "15                                        kip/spacebox/        yes  \n",
       "16    css/google-manual/f6946ab165caf661256632b7502e...        yes  \n",
       "17                                      media/index.htm        yes  \n",
       "18                                                             yes  \n",
       "19                                                 chas        yes  \n",
       "20                                 mukabele/106_107.htm         no  \n",
       "21                                        mlec/mlec.php        yes  \n",
       "22                                online/asb/asb.co.nz/        yes  \n",
       "23            docss/file/files/db/file.dropbox/form.php        yes  \n",
       "24                                                              no  \n",
       "25      mobile/impaye/5739e346002526519df9d8623b9c854b/        yes  \n",
       "26    wiki/commons:wiki_loves_monuments_2017_in_the_...         no  \n",
       "27    careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...         no  \n",
       "28         up/verification/7na1n7878n0b27m71d15/qes.php        yes  \n",
       "29                                   wp-yahoo/t/y1.html        yes  \n",
       "...                                                 ...        ...  \n",
       "1751                                    myresearch/home         no  \n",
       "1752  article/deceptive-networking-lures-hackers-wit...         no  \n",
       "1753                     drupal/sites/default/files/ub/        yes  \n",
       "1754  public/revery/revery/card.html?wo9spdzhykzcx2h...        yes  \n",
       "1755  components/com_joomlastats/fr/b69d7d0348bc9799...        yes  \n",
       "1756  includes/usaa/verification/9bd4c1dm321n45805n9...        yes  \n",
       "1757  asp/scrunsubscribe.aspx?cmdmkey=404433025&emai...         no  \n",
       "1758                         shopify-recurring-payments         no  \n",
       "1759                                                NaN        NaN  \n",
       "1760        fuzzywuzzy-fuzzy-string-matching-in-python/         no  \n",
       "1761                                                            no  \n",
       "1762             secure-domains/document/pvalidate.html        yes  \n",
       "1763                            silicon-valley/episodes         no  \n",
       "1764                                                            no  \n",
       "1765              p/76dxv?cmp=share_androidapp_facebook         no  \n",
       "1766                                  nab/cardinfo.html        yes  \n",
       "1767  recovery-answer.html?=10065877425?fb_source=bo...        yes  \n",
       "1768            stb/entreebam/informations-requises.php        yes  \n",
       "1769      successs/ssdsss/filessss/filessss/documentss/        yes  \n",
       "1770        ftm/ghost/30055bc987091413d1307854d418711f/        yes  \n",
       "1771  dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...        yes  \n",
       "1772  payment-update-01.html?fb_source=bookmark_apps...        yes  \n",
       "1773  includes/usaa/verification/baa9b99a51bd58d62d3...        yes  \n",
       "1774                                                            no  \n",
       "1775                                                en/         no  \n",
       "1776                                      document/u/1/         no  \n",
       "1777                       wp-includes/pomo/adobe2.html        yes  \n",
       "1778  medsynaptic/wp-content/themes/twentyseventeen/...        yes  \n",
       "1779   wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php        yes  \n",
       "1780                                          asb.co.nz        yes  \n",
       "\n",
       "[1781 rows x 4 columns]"
      ]
     },
     "execution_count": 29,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Domain name column can be further sub divided into domain_names as well as sub_domain_names \n",
    "\n",
    "Similarly, address column can also be further sub divided into path,query_string,file.................."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "pandas.core.frame.DataFrame"
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "type(splitted_data)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Features Extraction"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "\n",
    "Feature-1\n",
    "\n",
    "1.Long URL to Hide the Suspicious Part\n",
    "\n",
    "If the length of the URL is greater than or equal 54 characters then the URL classified as phishing\n",
    "\n",
    "\n",
    "0 --- indicates legitimate\n",
    "\n",
    "1 --- indicates Phishing\n",
    "\n",
    "2 --- indicates Suspicious"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [],
   "source": [
    "def long_url(l):\n",
    "    l= str(l)\n",
    "    \"\"\"This function is defined in order to differntiate website based on the length of the URL\"\"\"\n",
    "    if len(l) < 54:\n",
    "        return 0\n",
    "    elif len(l) >= 54 and len(l) <= 75:\n",
    "        return 2\n",
    "    return 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [],
   "source": [
    "#Applying the above defined function in order to divide the websites into 3 categories\n",
    "splitted_data['long_url'] = raw_data['URL'].apply(long_url) \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "      <th>long_url</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>http</td>\n",
       "      <td>www.7-zip.org</td>\n",
       "      <td>download.html</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>http</td>\n",
       "      <td>ebay.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>http</td>\n",
       "      <td>rodritol.com</td>\n",
       "      <td>components/kttm/dropbox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>https</td>\n",
       "      <td>evercoin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>http</td>\n",
       "      <td>www.phishtank.com</td>\n",
       "      <td>phish_archive.php</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>http</td>\n",
       "      <td>mawar-abdrahim.co.id</td>\n",
       "      <td>kip/spacebox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>http</td>\n",
       "      <td>www.telesport-tv.com.ar</td>\n",
       "      <td>media/index.htm</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>http</td>\n",
       "      <td>pixelpicturescorp.com</td>\n",
       "      <td></td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>http</td>\n",
       "      <td>puertovarasflyfishing.com</td>\n",
       "      <td>chas</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ortakhatim.com</td>\n",
       "      <td>mukabele/106_107.htm</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>http</td>\n",
       "      <td>les-avertis.net</td>\n",
       "      <td>mlec/mlec.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>http</td>\n",
       "      <td>www.rileysbrandhoney.com</td>\n",
       "      <td>online/asb/asb.co.nz/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>http</td>\n",
       "      <td>netflix.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>http</td>\n",
       "      <td>ovodfurnituremakers.com</td>\n",
       "      <td>wp-yahoo/t/y1.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>31</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ito.org.tr</td>\n",
       "      <td>wps/portal</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>34</th>\n",
       "      <td>http</td>\n",
       "      <td>ddarko.org</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>35</th>\n",
       "      <td>http</td>\n",
       "      <td>mateos.pl</td>\n",
       "      <td>bomiko_s/ajax/grid/fd/adeb/adobe.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>36</th>\n",
       "      <td>http</td>\n",
       "      <td>bit.ly</td>\n",
       "      <td>2qczflx</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>41</th>\n",
       "      <td>http</td>\n",
       "      <td>ebay.net.ua</td>\n",
       "      <td>catalog/show/300536646261</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42</th>\n",
       "      <td>http</td>\n",
       "      <td>untroubled.org</td>\n",
       "      <td>spam/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>52</th>\n",
       "      <td>http</td>\n",
       "      <td>barenthi-wertisob.tk</td>\n",
       "      <td>main/index.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>57</th>\n",
       "      <td>http</td>\n",
       "      <td>www.alindad.altervista.org</td>\n",
       "      <td>773/index.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>59</th>\n",
       "      <td>http</td>\n",
       "      <td>juliepagemakeup.com</td>\n",
       "      <td>cm.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>62</th>\n",
       "      <td>http</td>\n",
       "      <td>facebook.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>65</th>\n",
       "      <td>https</td>\n",
       "      <td>clarity.fm</td>\n",
       "      <td>questions/838/answers/2444</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>66</th>\n",
       "      <td>http</td>\n",
       "      <td>www.mlsecproject.org</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1712</th>\n",
       "      <td>http</td>\n",
       "      <td>atualizacaomobiile.com</td>\n",
       "      <td>santander/update.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1715</th>\n",
       "      <td>http</td>\n",
       "      <td>hry.yt</td>\n",
       "      <td>cvuqz</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1716</th>\n",
       "      <td>http</td>\n",
       "      <td>alert-fanpage98877.fangegee2.cf</td>\n",
       "      <td>payment.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1717</th>\n",
       "      <td>http</td>\n",
       "      <td>cbw-properties.com</td>\n",
       "      <td>rental-application</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1719</th>\n",
       "      <td>http</td>\n",
       "      <td>www.imdb.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1722</th>\n",
       "      <td>https</td>\n",
       "      <td>fleet.postmates.com</td>\n",
       "      <td>legal/agreement</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1723</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ito.org.tr</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1724</th>\n",
       "      <td>http</td>\n",
       "      <td>myintranet.cl</td>\n",
       "      <td>9cc/754me/z2v5/ohgo673g100/fwd</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1725</th>\n",
       "      <td>http</td>\n",
       "      <td>www.imdb.com</td>\n",
       "      <td>?ref_=nv_fb_lgin</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1727</th>\n",
       "      <td>http</td>\n",
       "      <td>www.pavancaters.com</td>\n",
       "      <td>doc/es</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1729</th>\n",
       "      <td>http</td>\n",
       "      <td>bit.ly</td>\n",
       "      <td>2vs56fz</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1737</th>\n",
       "      <td>https</td>\n",
       "      <td>ankiweb.net</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1739</th>\n",
       "      <td>http</td>\n",
       "      <td>www.navta.net</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1744</th>\n",
       "      <td>http</td>\n",
       "      <td>sec.gov</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1745</th>\n",
       "      <td>http</td>\n",
       "      <td>doordash.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1747</th>\n",
       "      <td>https</td>\n",
       "      <td>bylocksavunma.blogspot.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1748</th>\n",
       "      <td>http</td>\n",
       "      <td>www.hbogo.com</td>\n",
       "      <td>?camp=gos7</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1749</th>\n",
       "      <td>http</td>\n",
       "      <td>tureng.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1751</th>\n",
       "      <td>http</td>\n",
       "      <td>mvpl.enkilibrary.org</td>\n",
       "      <td>myresearch/home</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1758</th>\n",
       "      <td>https</td>\n",
       "      <td>apps.shopify.com</td>\n",
       "      <td>shopify-recurring-payments</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1759</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1761</th>\n",
       "      <td>http</td>\n",
       "      <td>www.sozce.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1763</th>\n",
       "      <td>http</td>\n",
       "      <td>www.hbo.com</td>\n",
       "      <td>silicon-valley/episodes</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1764</th>\n",
       "      <td>http</td>\n",
       "      <td>www.bbc.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1765</th>\n",
       "      <td>http</td>\n",
       "      <td>gu.com</td>\n",
       "      <td>p/76dxv?cmp=share_androidapp_facebook</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1766</th>\n",
       "      <td>http</td>\n",
       "      <td>malomolk.com</td>\n",
       "      <td>nab/cardinfo.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1774</th>\n",
       "      <td>http</td>\n",
       "      <td>www.dpincsupport.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1775</th>\n",
       "      <td>https</td>\n",
       "      <td>bitcoin.org</td>\n",
       "      <td>en/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1776</th>\n",
       "      <td>https</td>\n",
       "      <td>docs.google.com</td>\n",
       "      <td>document/u/1/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1780</th>\n",
       "      <td>https</td>\n",
       "      <td>stom05.ru</td>\n",
       "      <td>asb.co.nz</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>745 rows × 5 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     protocol                      domain_name  \\\n",
       "2        http                  code.google.com   \n",
       "3        http                     linkedin.com   \n",
       "4        http                   imageshack.com   \n",
       "6        http                    www.7-zip.org   \n",
       "7        http                         ebay.com   \n",
       "9        http          mobile-free.metulwx.com   \n",
       "11       http                     rodritol.com   \n",
       "13      https                     evercoin.com   \n",
       "14       http                www.phishtank.com   \n",
       "15       http             mawar-abdrahim.co.id   \n",
       "17       http          www.telesport-tv.com.ar   \n",
       "18       http            pixelpicturescorp.com   \n",
       "19       http        puertovarasflyfishing.com   \n",
       "20       http               www.ortakhatim.com   \n",
       "21       http                  les-avertis.net   \n",
       "22       http         www.rileysbrandhoney.com   \n",
       "24       http                      netflix.com   \n",
       "29       http          ovodfurnituremakers.com   \n",
       "31       http                   www.ito.org.tr   \n",
       "34       http                       ddarko.org   \n",
       "35       http                        mateos.pl   \n",
       "36       http                           bit.ly   \n",
       "41       http                      ebay.net.ua   \n",
       "42       http                   untroubled.org   \n",
       "52       http             barenthi-wertisob.tk   \n",
       "57       http       www.alindad.altervista.org   \n",
       "59       http              juliepagemakeup.com   \n",
       "62       http                     facebook.com   \n",
       "65      https                       clarity.fm   \n",
       "66       http             www.mlsecproject.org   \n",
       "...       ...                              ...   \n",
       "1712     http           atualizacaomobiile.com   \n",
       "1715     http                           hry.yt   \n",
       "1716     http  alert-fanpage98877.fangegee2.cf   \n",
       "1717     http               cbw-properties.com   \n",
       "1719     http                     www.imdb.com   \n",
       "1722    https              fleet.postmates.com   \n",
       "1723     http                   www.ito.org.tr   \n",
       "1724     http                    myintranet.cl   \n",
       "1725     http                     www.imdb.com   \n",
       "1727     http              www.pavancaters.com   \n",
       "1729     http                           bit.ly   \n",
       "1737    https                      ankiweb.net   \n",
       "1739     http                    www.navta.net   \n",
       "1744     http                          sec.gov   \n",
       "1745     http                     doordash.com   \n",
       "1747    https       bylocksavunma.blogspot.com   \n",
       "1748     http                    www.hbogo.com   \n",
       "1749     http                       tureng.com   \n",
       "1751     http             mvpl.enkilibrary.org   \n",
       "1758    https                 apps.shopify.com   \n",
       "1759      NaN                              NaN   \n",
       "1761     http                    www.sozce.com   \n",
       "1763     http                      www.hbo.com   \n",
       "1764     http                      www.bbc.com   \n",
       "1765     http                           gu.com   \n",
       "1766     http                     malomolk.com   \n",
       "1774     http             www.dpincsupport.com   \n",
       "1775    https                      bitcoin.org   \n",
       "1776    https                  docs.google.com   \n",
       "1780    https                        stom05.ru   \n",
       "\n",
       "                                    address is_phished  long_url  \n",
       "2                          p/pylevenshtein/         no         0  \n",
       "3                                                   no         0  \n",
       "4                       f/219/cadir2yr3.jpg         no         0  \n",
       "6                             download.html         no         0  \n",
       "7                                                   no         0  \n",
       "9                            mobile/impaye/        yes         0  \n",
       "11                 components/kttm/dropbox/        yes         0  \n",
       "13                                                  no         0  \n",
       "14                        phish_archive.php         no         0  \n",
       "15                            kip/spacebox/        yes         0  \n",
       "17                          media/index.htm        yes         0  \n",
       "18                                                 yes         0  \n",
       "19                                     chas        yes         0  \n",
       "20                     mukabele/106_107.htm         no         0  \n",
       "21                            mlec/mlec.php        yes         0  \n",
       "22                    online/asb/asb.co.nz/        yes         0  \n",
       "24                                                  no         0  \n",
       "29                       wp-yahoo/t/y1.html        yes         0  \n",
       "31                               wps/portal         no         0  \n",
       "34                                                  no         0  \n",
       "35     bomiko_s/ajax/grid/fd/adeb/adobe.php        yes         0  \n",
       "36                                  2qczflx        yes         0  \n",
       "41                catalog/show/300536646261        yes         0  \n",
       "42                                    spam/         no         0  \n",
       "52                          main/index.html        yes         0  \n",
       "57                            773/index.php        yes         0  \n",
       "59                                   cm.php        yes         0  \n",
       "62                                                  no         0  \n",
       "65               questions/838/answers/2444         no         0  \n",
       "66                                                  no         0  \n",
       "...                                     ...        ...       ...  \n",
       "1712                   santander/update.php        yes         0  \n",
       "1715                                  cvuqz         no         0  \n",
       "1716                           payment.html        yes         0  \n",
       "1717                     rental-application         no         0  \n",
       "1719                                                no         0  \n",
       "1722                        legal/agreement         no         0  \n",
       "1723                                                no         0  \n",
       "1724         9cc/754me/z2v5/ohgo673g100/fwd        yes         0  \n",
       "1725                       ?ref_=nv_fb_lgin         no         0  \n",
       "1727                                 doc/es        yes         0  \n",
       "1729                                2vs56fz         no         0  \n",
       "1737                                                no         0  \n",
       "1739                                                no         0  \n",
       "1744                                                no         0  \n",
       "1745                                                no         0  \n",
       "1747                                                no         0  \n",
       "1748                             ?camp=gos7         no         0  \n",
       "1749                                                no         0  \n",
       "1751                        myresearch/home         no         0  \n",
       "1758             shopify-recurring-payments         no         0  \n",
       "1759                                    NaN        NaN         0  \n",
       "1761                                                no         0  \n",
       "1763                silicon-valley/episodes         no         0  \n",
       "1764                                                no         0  \n",
       "1765  p/76dxv?cmp=share_androidapp_facebook         no         0  \n",
       "1766                      nab/cardinfo.html        yes         0  \n",
       "1774                                                no         0  \n",
       "1775                                    en/         no         0  \n",
       "1776                          document/u/1/         no         0  \n",
       "1780                              asb.co.nz        yes         0  \n",
       "\n",
       "[745 rows x 5 columns]"
      ]
     },
     "execution_count": 33,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Will show the results only the websites which are legitimate according to above condition as 0 is legitimate website\n",
    "splitted_data[splitted_data.long_url == 0] "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feature-2\n",
    "\n",
    "2.URL’s having “@” Symbol\n",
    "\n",
    "Using “@” symbol in the URL leads the browser to ignore everything preceding the “@” symbol and the real address often follows the “@” symbol.\n",
    "\n",
    "IF {Url Having @ Symbol→ Phishing\n",
    "    Otherwise→ Legitimate }\n",
    "\n",
    "\n",
    "0 --- indicates legitimate\n",
    "\n",
    "1 --- indicates Phishing\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [],
   "source": [
    "def have_at_symbol(l):\n",
    "    \"\"\"This function is used to check whether the URL contains @ symbol or not\"\"\"\n",
    "    if \"@\" in str(l):\n",
    "        return 1\n",
    "    return 0\n",
    "    "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data['having_@_symbol'] = raw_data['URL'].apply(have_at_symbol)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "      <th>long_url</th>\n",
       "      <th>having_@_symbol</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>https</td>\n",
       "      <td>doc-08-bc-apps-viewer.googleusercontent.com</td>\n",
       "      <td>viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>http</td>\n",
       "      <td>www.7-zip.org</td>\n",
       "      <td>download.html</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>http</td>\n",
       "      <td>ebay.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>https</td>\n",
       "      <td>login.yahoo.com</td>\n",
       "      <td>config/login?.done=https%3a%2f%2fapi.login.yah...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gulfshield.com</td>\n",
       "      <td>uploads/gallery/mankind/secure/fiscal/manual/m...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>http</td>\n",
       "      <td>rodritol.com</td>\n",
       "      <td>components/kttm/dropbox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>https</td>\n",
       "      <td>ecommerce-platforms.com</td>\n",
       "      <td>articles/top-6-ecommerce-platform-reviews-2012...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>https</td>\n",
       "      <td>evercoin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>http</td>\n",
       "      <td>www.phishtank.com</td>\n",
       "      <td>phish_archive.php</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>http</td>\n",
       "      <td>mawar-abdrahim.co.id</td>\n",
       "      <td>kip/spacebox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>http</td>\n",
       "      <td>jovan.soldatovic.org</td>\n",
       "      <td>css/google-manual/f6946ab165caf661256632b7502e...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>http</td>\n",
       "      <td>www.telesport-tv.com.ar</td>\n",
       "      <td>media/index.htm</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>http</td>\n",
       "      <td>pixelpicturescorp.com</td>\n",
       "      <td></td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>http</td>\n",
       "      <td>puertovarasflyfishing.com</td>\n",
       "      <td>chas</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ortakhatim.com</td>\n",
       "      <td>mukabele/106_107.htm</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>http</td>\n",
       "      <td>les-avertis.net</td>\n",
       "      <td>mlec/mlec.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>http</td>\n",
       "      <td>www.rileysbrandhoney.com</td>\n",
       "      <td>online/asb/asb.co.nz/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>http</td>\n",
       "      <td>girlsneedhelp.info</td>\n",
       "      <td>docss/file/files/db/file.dropbox/form.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>http</td>\n",
       "      <td>netflix.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/5739e346002526519df9d8623b9c854b/</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>https</td>\n",
       "      <td>commons.wikimedia.org</td>\n",
       "      <td>wiki/commons:wiki_loves_monuments_2017_in_the_...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>https</td>\n",
       "      <td>jobs.jobvite.com</td>\n",
       "      <td>careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>http</td>\n",
       "      <td>log-upgrade-helpdata-isetting-data-us.akunnet.com</td>\n",
       "      <td>up/verification/7na1n7878n0b27m71d15/qes.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>http</td>\n",
       "      <td>ovodfurnituremakers.com</td>\n",
       "      <td>wp-yahoo/t/y1.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1751</th>\n",
       "      <td>http</td>\n",
       "      <td>mvpl.enkilibrary.org</td>\n",
       "      <td>myresearch/home</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1752</th>\n",
       "      <td>http</td>\n",
       "      <td>www.techrepublic.com</td>\n",
       "      <td>article/deceptive-networking-lures-hackers-wit...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1753</th>\n",
       "      <td>http</td>\n",
       "      <td>naleoserver.3disystems.com</td>\n",
       "      <td>drupal/sites/default/files/ub/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1754</th>\n",
       "      <td>https</td>\n",
       "      <td>app-1506806908.000webhostapp.com</td>\n",
       "      <td>public/revery/revery/card.html?wo9spdzhykzcx2h...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1755</th>\n",
       "      <td>http</td>\n",
       "      <td>stephanehamard.com</td>\n",
       "      <td>components/com_joomlastats/fr/b69d7d0348bc9799...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1756</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/9bd4c1dm321n45805n9...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1757</th>\n",
       "      <td>http</td>\n",
       "      <td>kampanya.qnbfinansbank.com</td>\n",
       "      <td>asp/scrunsubscribe.aspx?cmdmkey=404433025&amp;emai...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1758</th>\n",
       "      <td>https</td>\n",
       "      <td>apps.shopify.com</td>\n",
       "      <td>shopify-recurring-payments</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1759</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1760</th>\n",
       "      <td>http</td>\n",
       "      <td>chairnerd.seatgeek.com</td>\n",
       "      <td>fuzzywuzzy-fuzzy-string-matching-in-python/</td>\n",
       "      <td>no</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1761</th>\n",
       "      <td>http</td>\n",
       "      <td>www.sozce.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1762</th>\n",
       "      <td>http</td>\n",
       "      <td>snackenak.co.id</td>\n",
       "      <td>secure-domains/document/pvalidate.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1763</th>\n",
       "      <td>http</td>\n",
       "      <td>www.hbo.com</td>\n",
       "      <td>silicon-valley/episodes</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1764</th>\n",
       "      <td>http</td>\n",
       "      <td>www.bbc.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1765</th>\n",
       "      <td>http</td>\n",
       "      <td>gu.com</td>\n",
       "      <td>p/76dxv?cmp=share_androidapp_facebook</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1766</th>\n",
       "      <td>http</td>\n",
       "      <td>malomolk.com</td>\n",
       "      <td>nab/cardinfo.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1767</th>\n",
       "      <td>https</td>\n",
       "      <td>goodlogstext4004.000webhostapp.com</td>\n",
       "      <td>recovery-answer.html?=10065877425?fb_source=bo...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1768</th>\n",
       "      <td>http</td>\n",
       "      <td>particuliers.secure.credit-agricole.fr.mtoffic...</td>\n",
       "      <td>stb/entreebam/informations-requises.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1769</th>\n",
       "      <td>http</td>\n",
       "      <td>confrecor.org</td>\n",
       "      <td>successs/ssdsss/filessss/filessss/documentss/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1770</th>\n",
       "      <td>http</td>\n",
       "      <td>eltonjohncover.com.br</td>\n",
       "      <td>ftm/ghost/30055bc987091413d1307854d418711f/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1771</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gettingpaidtopayattention.com</td>\n",
       "      <td>dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1772</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-01.html?fb_source=bookmark_apps...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1773</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/baa9b99a51bd58d62d3...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1774</th>\n",
       "      <td>http</td>\n",
       "      <td>www.dpincsupport.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1775</th>\n",
       "      <td>https</td>\n",
       "      <td>bitcoin.org</td>\n",
       "      <td>en/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1776</th>\n",
       "      <td>https</td>\n",
       "      <td>docs.google.com</td>\n",
       "      <td>document/u/1/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1777</th>\n",
       "      <td>http</td>\n",
       "      <td>www.charlestodd.com</td>\n",
       "      <td>wp-includes/pomo/adobe2.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1778</th>\n",
       "      <td>http</td>\n",
       "      <td>tslimpact.com</td>\n",
       "      <td>medsynaptic/wp-content/themes/twentyseventeen/...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1779</th>\n",
       "      <td>http</td>\n",
       "      <td>daoudilorin11.mystagingwebsite.com</td>\n",
       "      <td>wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1780</th>\n",
       "      <td>https</td>\n",
       "      <td>stom05.ru</td>\n",
       "      <td>asb.co.nz</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1781 rows × 6 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     protocol                                        domain_name  \\\n",
       "0       https              locking-app-adverds.000webhostapp.com   \n",
       "1        http                        www.myhealthcarepharmacy.ca   \n",
       "2        http                                    code.google.com   \n",
       "3        http                                       linkedin.com   \n",
       "4        http                                     imageshack.com   \n",
       "5       https        doc-08-bc-apps-viewer.googleusercontent.com   \n",
       "6        http                                      www.7-zip.org   \n",
       "7        http                                           ebay.com   \n",
       "8       https                                    login.yahoo.com   \n",
       "9        http                            mobile-free.metulwx.com   \n",
       "10      https                                 www.gulfshield.com   \n",
       "11       http                                       rodritol.com   \n",
       "12      https                            ecommerce-platforms.com   \n",
       "13      https                                       evercoin.com   \n",
       "14       http                                  www.phishtank.com   \n",
       "15       http                               mawar-abdrahim.co.id   \n",
       "16       http                               jovan.soldatovic.org   \n",
       "17       http                            www.telesport-tv.com.ar   \n",
       "18       http                              pixelpicturescorp.com   \n",
       "19       http                          puertovarasflyfishing.com   \n",
       "20       http                                 www.ortakhatim.com   \n",
       "21       http                                    les-avertis.net   \n",
       "22       http                           www.rileysbrandhoney.com   \n",
       "23       http                                 girlsneedhelp.info   \n",
       "24       http                                        netflix.com   \n",
       "25       http                            mobile-free.metulwx.com   \n",
       "26      https                              commons.wikimedia.org   \n",
       "27      https                                   jobs.jobvite.com   \n",
       "28       http  log-upgrade-helpdata-isetting-data-us.akunnet.com   \n",
       "29       http                            ovodfurnituremakers.com   \n",
       "...       ...                                                ...   \n",
       "1751     http                               mvpl.enkilibrary.org   \n",
       "1752     http                               www.techrepublic.com   \n",
       "1753     http                         naleoserver.3disystems.com   \n",
       "1754    https                   app-1506806908.000webhostapp.com   \n",
       "1755     http                                 stephanehamard.com   \n",
       "1756     http                          www.scuolasci-dolomiti.it   \n",
       "1757     http                         kampanya.qnbfinansbank.com   \n",
       "1758    https                                   apps.shopify.com   \n",
       "1759      NaN                                                NaN   \n",
       "1760     http                             chairnerd.seatgeek.com   \n",
       "1761     http                                      www.sozce.com   \n",
       "1762     http                                    snackenak.co.id   \n",
       "1763     http                                        www.hbo.com   \n",
       "1764     http                                        www.bbc.com   \n",
       "1765     http                                             gu.com   \n",
       "1766     http                                       malomolk.com   \n",
       "1767    https                 goodlogstext4004.000webhostapp.com   \n",
       "1768     http  particuliers.secure.credit-agricole.fr.mtoffic...   \n",
       "1769     http                                      confrecor.org   \n",
       "1770     http                              eltonjohncover.com.br   \n",
       "1771    https                  www.gettingpaidtopayattention.com   \n",
       "1772    https              locking-app-adverds.000webhostapp.com   \n",
       "1773     http                          www.scuolasci-dolomiti.it   \n",
       "1774     http                               www.dpincsupport.com   \n",
       "1775    https                                        bitcoin.org   \n",
       "1776    https                                    docs.google.com   \n",
       "1777     http                                www.charlestodd.com   \n",
       "1778     http                                      tslimpact.com   \n",
       "1779     http                 daoudilorin11.mystagingwebsite.com   \n",
       "1780    https                                          stom05.ru   \n",
       "\n",
       "                                                address is_phished  long_url  \\\n",
       "0     payment-update-0.html?fb_source=bookmark_apps&...        yes         1   \n",
       "1                         wp-includes/js/jquery/ini.php        yes         2   \n",
       "2                                      p/pylevenshtein/         no         0   \n",
       "3                                                               no         0   \n",
       "4                                   f/219/cadir2yr3.jpg         no         0   \n",
       "5     viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...         no         1   \n",
       "6                                         download.html         no         0   \n",
       "7                                                               no         0   \n",
       "8     config/login?.done=https%3a%2f%2fapi.login.yah...         no         1   \n",
       "9                                        mobile/impaye/        yes         0   \n",
       "10    uploads/gallery/mankind/secure/fiscal/manual/m...        yes         1   \n",
       "11                             components/kttm/dropbox/        yes         0   \n",
       "12    articles/top-6-ecommerce-platform-reviews-2012...         no         1   \n",
       "13                                                              no         0   \n",
       "14                                    phish_archive.php         no         0   \n",
       "15                                        kip/spacebox/        yes         0   \n",
       "16    css/google-manual/f6946ab165caf661256632b7502e...        yes         1   \n",
       "17                                      media/index.htm        yes         0   \n",
       "18                                                             yes         0   \n",
       "19                                                 chas        yes         0   \n",
       "20                                 mukabele/106_107.htm         no         0   \n",
       "21                                        mlec/mlec.php        yes         0   \n",
       "22                                online/asb/asb.co.nz/        yes         0   \n",
       "23            docss/file/files/db/file.dropbox/form.php        yes         2   \n",
       "24                                                              no         0   \n",
       "25      mobile/impaye/5739e346002526519df9d8623b9c854b/        yes         1   \n",
       "26    wiki/commons:wiki_loves_monuments_2017_in_the_...         no         1   \n",
       "27    careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...         no         1   \n",
       "28         up/verification/7na1n7878n0b27m71d15/qes.php        yes         1   \n",
       "29                                   wp-yahoo/t/y1.html        yes         0   \n",
       "...                                                 ...        ...       ...   \n",
       "1751                                    myresearch/home         no         0   \n",
       "1752  article/deceptive-networking-lures-hackers-wit...         no         1   \n",
       "1753                     drupal/sites/default/files/ub/        yes         2   \n",
       "1754  public/revery/revery/card.html?wo9spdzhykzcx2h...        yes         1   \n",
       "1755  components/com_joomlastats/fr/b69d7d0348bc9799...        yes         1   \n",
       "1756  includes/usaa/verification/9bd4c1dm321n45805n9...        yes         1   \n",
       "1757  asp/scrunsubscribe.aspx?cmdmkey=404433025&emai...         no         1   \n",
       "1758                         shopify-recurring-payments         no         0   \n",
       "1759                                                NaN        NaN         0   \n",
       "1760        fuzzywuzzy-fuzzy-string-matching-in-python/         no         2   \n",
       "1761                                                            no         0   \n",
       "1762             secure-domains/document/pvalidate.html        yes         2   \n",
       "1763                            silicon-valley/episodes         no         0   \n",
       "1764                                                            no         0   \n",
       "1765              p/76dxv?cmp=share_androidapp_facebook         no         0   \n",
       "1766                                  nab/cardinfo.html        yes         0   \n",
       "1767  recovery-answer.html?=10065877425?fb_source=bo...        yes         1   \n",
       "1768            stb/entreebam/informations-requises.php        yes         1   \n",
       "1769      successs/ssdsss/filessss/filessss/documentss/        yes         2   \n",
       "1770        ftm/ghost/30055bc987091413d1307854d418711f/        yes         2   \n",
       "1771  dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...        yes         1   \n",
       "1772  payment-update-01.html?fb_source=bookmark_apps...        yes         1   \n",
       "1773  includes/usaa/verification/baa9b99a51bd58d62d3...        yes         1   \n",
       "1774                                                            no         0   \n",
       "1775                                                en/         no         0   \n",
       "1776                                      document/u/1/         no         0   \n",
       "1777                       wp-includes/pomo/adobe2.html        yes         2   \n",
       "1778  medsynaptic/wp-content/themes/twentyseventeen/...        yes         1   \n",
       "1779   wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php        yes         1   \n",
       "1780                                          asb.co.nz        yes         0   \n",
       "\n",
       "      having_@_symbol  \n",
       "0                   0  \n",
       "1                   0  \n",
       "2                   0  \n",
       "3                   0  \n",
       "4                   0  \n",
       "5                   0  \n",
       "6                   0  \n",
       "7                   0  \n",
       "8                   0  \n",
       "9                   0  \n",
       "10                  0  \n",
       "11                  0  \n",
       "12                  0  \n",
       "13                  0  \n",
       "14                  0  \n",
       "15                  0  \n",
       "16                  0  \n",
       "17                  0  \n",
       "18                  0  \n",
       "19                  0  \n",
       "20                  0  \n",
       "21                  0  \n",
       "22                  0  \n",
       "23                  0  \n",
       "24                  0  \n",
       "25                  0  \n",
       "26                  0  \n",
       "27                  0  \n",
       "28                  0  \n",
       "29                  0  \n",
       "...               ...  \n",
       "1751                0  \n",
       "1752                0  \n",
       "1753                0  \n",
       "1754                0  \n",
       "1755                0  \n",
       "1756                0  \n",
       "1757                0  \n",
       "1758                0  \n",
       "1759                0  \n",
       "1760                0  \n",
       "1761                0  \n",
       "1762                0  \n",
       "1763                0  \n",
       "1764                0  \n",
       "1765                0  \n",
       "1766                0  \n",
       "1767                0  \n",
       "1768                0  \n",
       "1769                0  \n",
       "1770                0  \n",
       "1771                0  \n",
       "1772                0  \n",
       "1773                0  \n",
       "1774                0  \n",
       "1775                0  \n",
       "1776                0  \n",
       "1777                0  \n",
       "1778                0  \n",
       "1779                0  \n",
       "1780                0  \n",
       "\n",
       "[1781 rows x 6 columns]"
      ]
     },
     "execution_count": 36,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feature-3\n",
    "\n",
    "3.Redirecting using “//”\n",
    "\n",
    "The existence of “//” within the URL path means that the user will be redirected to another website.\n",
    "An example of such URL’s is: “http://www.legitimate.com//http://www.phishing.com”. \n",
    "We examine the location where the “//” appears. \n",
    "We find that if the URL starts with “HTTP”, that means the “//” should appear in the sixth position. \n",
    "However, if the URL employs “HTTPS” then the “//” should appear in seventh position.\n",
    "\n",
    "IF {ThePosition of the Last Occurrence of \"//\" in the URL > 7→ Phishing\n",
    "    \n",
    "    Otherwise→ Legitimate\n",
    "\n",
    "0 --- indicates legitimate\n",
    "\n",
    "1 --- indicates Phishing\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [],
   "source": [
    "def redirection(l):\n",
    "    \"\"\"If the url has symbol(//) after protocol then such URL is to be classified as phishing \"\"\"\n",
    "    if \"//\" in str(l):\n",
    "        return 1\n",
    "    return 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data['redirection_//_symbol'] = seperation_of_protocol[1].apply(redirection)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "      <th>long_url</th>\n",
       "      <th>having_@_symbol</th>\n",
       "      <th>redirection_//_symbol</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  protocol                            domain_name  \\\n",
       "0    https  locking-app-adverds.000webhostapp.com   \n",
       "1     http            www.myhealthcarepharmacy.ca   \n",
       "2     http                        code.google.com   \n",
       "3     http                           linkedin.com   \n",
       "4     http                         imageshack.com   \n",
       "\n",
       "                                             address is_phished  long_url  \\\n",
       "0  payment-update-0.html?fb_source=bookmark_apps&...        yes         1   \n",
       "1                      wp-includes/js/jquery/ini.php        yes         2   \n",
       "2                                   p/pylevenshtein/         no         0   \n",
       "3                                                            no         0   \n",
       "4                                f/219/cadir2yr3.jpg         no         0   \n",
       "\n",
       "   having_@_symbol  redirection_//_symbol  \n",
       "0                0                      0  \n",
       "1                0                      0  \n",
       "2                0                      0  \n",
       "3                0                      0  \n",
       "4                0                      0  "
      ]
     },
     "execution_count": 39,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feature-4\n",
    "\n",
    "4.Adding Prefix or Suffix Separated by (-) to the Domain\n",
    "\n",
    "The dash symbol is rarely used in legitimate URLs. Phishers tend to add prefixes or suffixes separated by (-) to the domain name\n",
    "so that users feel that they are dealing with a legitimate webpage. \n",
    "\n",
    "For example http://www.Confirme-paypal.com/.\n",
    "    \n",
    "IF {Domain Name Part Includes (−) Symbol → Phishing\n",
    "    \n",
    "    Otherwise → Legitimate\n",
    "    \n",
    "1 --> indicates phishing\n",
    "\n",
    "0 --> indicates legitimate\n",
    "    "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "metadata": {},
   "outputs": [],
   "source": [
    "def prefix_suffix_seperation(l):\n",
    "    if '-' in str(l):\n",
    "        return 1\n",
    "    return 0"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data['prefix_suffix_seperation'] = seperation_domain_name['domain_name'].apply(prefix_suffix_seperation)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "      <th>long_url</th>\n",
       "      <th>having_@_symbol</th>\n",
       "      <th>redirection_//_symbol</th>\n",
       "      <th>prefix_suffix_seperation</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  protocol                            domain_name  \\\n",
       "0    https  locking-app-adverds.000webhostapp.com   \n",
       "1     http            www.myhealthcarepharmacy.ca   \n",
       "2     http                        code.google.com   \n",
       "3     http                           linkedin.com   \n",
       "4     http                         imageshack.com   \n",
       "\n",
       "                                             address is_phished  long_url  \\\n",
       "0  payment-update-0.html?fb_source=bookmark_apps&...        yes         1   \n",
       "1                      wp-includes/js/jquery/ini.php        yes         2   \n",
       "2                                   p/pylevenshtein/         no         0   \n",
       "3                                                            no         0   \n",
       "4                                f/219/cadir2yr3.jpg         no         0   \n",
       "\n",
       "   having_@_symbol  redirection_//_symbol  prefix_suffix_seperation  \n",
       "0                0                      0                         1  \n",
       "1                0                      0                         0  \n",
       "2                0                      0                         0  \n",
       "3                0                      0                         0  \n",
       "4                0                      0                         0  "
      ]
     },
     "execution_count": 42,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data.head()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Feature - 5\n",
    "\n",
    "5. Sub-Domain and Multi Sub-Domains\n",
    "\n",
    "The legitimate URL link has two dots in the URL since we can ignore typing “www.”. \n",
    "If the number of dots is equal to three then the URL is classified as “Suspicious” since it has one sub-domain.\n",
    "However, if the dots are greater than three it is classified as “Phishy” since it will have multiple sub-domains\n",
    "\n",
    "0 --- indicates legitimate\n",
    "\n",
    "1 --- indicates Phishing\n",
    "\n",
    "2 --- indicates Suspicious\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [],
   "source": [
    "def sub_domains(l):\n",
    "    l= str(l)\n",
    "    if l.count('.') < 3:\n",
    "        return 0\n",
    "    elif l.count('.') == 3:\n",
    "        return 2\n",
    "    return 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [],
   "source": [
    "splitted_data['sub_domains'] = splitted_data['domain_name'].apply(sub_domains)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>protocol</th>\n",
       "      <th>domain_name</th>\n",
       "      <th>address</th>\n",
       "      <th>is_phished</th>\n",
       "      <th>long_url</th>\n",
       "      <th>having_@_symbol</th>\n",
       "      <th>redirection_//_symbol</th>\n",
       "      <th>prefix_suffix_seperation</th>\n",
       "      <th>sub_domains</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-0.html?fb_source=bookmark_apps&amp;...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>http</td>\n",
       "      <td>www.myhealthcarepharmacy.ca</td>\n",
       "      <td>wp-includes/js/jquery/ini.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>http</td>\n",
       "      <td>code.google.com</td>\n",
       "      <td>p/pylevenshtein/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>http</td>\n",
       "      <td>linkedin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>http</td>\n",
       "      <td>imageshack.com</td>\n",
       "      <td>f/219/cadir2yr3.jpg</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>https</td>\n",
       "      <td>doc-08-bc-apps-viewer.googleusercontent.com</td>\n",
       "      <td>viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>http</td>\n",
       "      <td>www.7-zip.org</td>\n",
       "      <td>download.html</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>http</td>\n",
       "      <td>ebay.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>https</td>\n",
       "      <td>login.yahoo.com</td>\n",
       "      <td>config/login?.done=https%3a%2f%2fapi.login.yah...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gulfshield.com</td>\n",
       "      <td>uploads/gallery/mankind/secure/fiscal/manual/m...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>http</td>\n",
       "      <td>rodritol.com</td>\n",
       "      <td>components/kttm/dropbox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>https</td>\n",
       "      <td>ecommerce-platforms.com</td>\n",
       "      <td>articles/top-6-ecommerce-platform-reviews-2012...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>https</td>\n",
       "      <td>evercoin.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>http</td>\n",
       "      <td>www.phishtank.com</td>\n",
       "      <td>phish_archive.php</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>http</td>\n",
       "      <td>mawar-abdrahim.co.id</td>\n",
       "      <td>kip/spacebox/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>http</td>\n",
       "      <td>jovan.soldatovic.org</td>\n",
       "      <td>css/google-manual/f6946ab165caf661256632b7502e...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>http</td>\n",
       "      <td>www.telesport-tv.com.ar</td>\n",
       "      <td>media/index.htm</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>http</td>\n",
       "      <td>pixelpicturescorp.com</td>\n",
       "      <td></td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>http</td>\n",
       "      <td>puertovarasflyfishing.com</td>\n",
       "      <td>chas</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>http</td>\n",
       "      <td>www.ortakhatim.com</td>\n",
       "      <td>mukabele/106_107.htm</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>http</td>\n",
       "      <td>les-avertis.net</td>\n",
       "      <td>mlec/mlec.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>http</td>\n",
       "      <td>www.rileysbrandhoney.com</td>\n",
       "      <td>online/asb/asb.co.nz/</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>http</td>\n",
       "      <td>girlsneedhelp.info</td>\n",
       "      <td>docss/file/files/db/file.dropbox/form.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>http</td>\n",
       "      <td>netflix.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>http</td>\n",
       "      <td>mobile-free.metulwx.com</td>\n",
       "      <td>mobile/impaye/5739e346002526519df9d8623b9c854b/</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>https</td>\n",
       "      <td>commons.wikimedia.org</td>\n",
       "      <td>wiki/commons:wiki_loves_monuments_2017_in_the_...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>https</td>\n",
       "      <td>jobs.jobvite.com</td>\n",
       "      <td>careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>http</td>\n",
       "      <td>log-upgrade-helpdata-isetting-data-us.akunnet.com</td>\n",
       "      <td>up/verification/7na1n7878n0b27m71d15/qes.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>http</td>\n",
       "      <td>ovodfurnituremakers.com</td>\n",
       "      <td>wp-yahoo/t/y1.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1751</th>\n",
       "      <td>http</td>\n",
       "      <td>mvpl.enkilibrary.org</td>\n",
       "      <td>myresearch/home</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1752</th>\n",
       "      <td>http</td>\n",
       "      <td>www.techrepublic.com</td>\n",
       "      <td>article/deceptive-networking-lures-hackers-wit...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1753</th>\n",
       "      <td>http</td>\n",
       "      <td>naleoserver.3disystems.com</td>\n",
       "      <td>drupal/sites/default/files/ub/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1754</th>\n",
       "      <td>https</td>\n",
       "      <td>app-1506806908.000webhostapp.com</td>\n",
       "      <td>public/revery/revery/card.html?wo9spdzhykzcx2h...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1755</th>\n",
       "      <td>http</td>\n",
       "      <td>stephanehamard.com</td>\n",
       "      <td>components/com_joomlastats/fr/b69d7d0348bc9799...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1756</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/9bd4c1dm321n45805n9...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1757</th>\n",
       "      <td>http</td>\n",
       "      <td>kampanya.qnbfinansbank.com</td>\n",
       "      <td>asp/scrunsubscribe.aspx?cmdmkey=404433025&amp;emai...</td>\n",
       "      <td>no</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1758</th>\n",
       "      <td>https</td>\n",
       "      <td>apps.shopify.com</td>\n",
       "      <td>shopify-recurring-payments</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1759</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1760</th>\n",
       "      <td>http</td>\n",
       "      <td>chairnerd.seatgeek.com</td>\n",
       "      <td>fuzzywuzzy-fuzzy-string-matching-in-python/</td>\n",
       "      <td>no</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1761</th>\n",
       "      <td>http</td>\n",
       "      <td>www.sozce.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1762</th>\n",
       "      <td>http</td>\n",
       "      <td>snackenak.co.id</td>\n",
       "      <td>secure-domains/document/pvalidate.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1763</th>\n",
       "      <td>http</td>\n",
       "      <td>www.hbo.com</td>\n",
       "      <td>silicon-valley/episodes</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1764</th>\n",
       "      <td>http</td>\n",
       "      <td>www.bbc.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1765</th>\n",
       "      <td>http</td>\n",
       "      <td>gu.com</td>\n",
       "      <td>p/76dxv?cmp=share_androidapp_facebook</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1766</th>\n",
       "      <td>http</td>\n",
       "      <td>malomolk.com</td>\n",
       "      <td>nab/cardinfo.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1767</th>\n",
       "      <td>https</td>\n",
       "      <td>goodlogstext4004.000webhostapp.com</td>\n",
       "      <td>recovery-answer.html?=10065877425?fb_source=bo...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1768</th>\n",
       "      <td>http</td>\n",
       "      <td>particuliers.secure.credit-agricole.fr.mtoffic...</td>\n",
       "      <td>stb/entreebam/informations-requises.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1769</th>\n",
       "      <td>http</td>\n",
       "      <td>confrecor.org</td>\n",
       "      <td>successs/ssdsss/filessss/filessss/documentss/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1770</th>\n",
       "      <td>http</td>\n",
       "      <td>eltonjohncover.com.br</td>\n",
       "      <td>ftm/ghost/30055bc987091413d1307854d418711f/</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1771</th>\n",
       "      <td>https</td>\n",
       "      <td>www.gettingpaidtopayattention.com</td>\n",
       "      <td>dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1772</th>\n",
       "      <td>https</td>\n",
       "      <td>locking-app-adverds.000webhostapp.com</td>\n",
       "      <td>payment-update-01.html?fb_source=bookmark_apps...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1773</th>\n",
       "      <td>http</td>\n",
       "      <td>www.scuolasci-dolomiti.it</td>\n",
       "      <td>includes/usaa/verification/baa9b99a51bd58d62d3...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1774</th>\n",
       "      <td>http</td>\n",
       "      <td>www.dpincsupport.com</td>\n",
       "      <td></td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1775</th>\n",
       "      <td>https</td>\n",
       "      <td>bitcoin.org</td>\n",
       "      <td>en/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1776</th>\n",
       "      <td>https</td>\n",
       "      <td>docs.google.com</td>\n",
       "      <td>document/u/1/</td>\n",
       "      <td>no</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1777</th>\n",
       "      <td>http</td>\n",
       "      <td>www.charlestodd.com</td>\n",
       "      <td>wp-includes/pomo/adobe2.html</td>\n",
       "      <td>yes</td>\n",
       "      <td>2</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1778</th>\n",
       "      <td>http</td>\n",
       "      <td>tslimpact.com</td>\n",
       "      <td>medsynaptic/wp-content/themes/twentyseventeen/...</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1779</th>\n",
       "      <td>http</td>\n",
       "      <td>daoudilorin11.mystagingwebsite.com</td>\n",
       "      <td>wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php</td>\n",
       "      <td>yes</td>\n",
       "      <td>1</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1780</th>\n",
       "      <td>https</td>\n",
       "      <td>stom05.ru</td>\n",
       "      <td>asb.co.nz</td>\n",
       "      <td>yes</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1781 rows × 9 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "     protocol                                        domain_name  \\\n",
       "0       https              locking-app-adverds.000webhostapp.com   \n",
       "1        http                        www.myhealthcarepharmacy.ca   \n",
       "2        http                                    code.google.com   \n",
       "3        http                                       linkedin.com   \n",
       "4        http                                     imageshack.com   \n",
       "5       https        doc-08-bc-apps-viewer.googleusercontent.com   \n",
       "6        http                                      www.7-zip.org   \n",
       "7        http                                           ebay.com   \n",
       "8       https                                    login.yahoo.com   \n",
       "9        http                            mobile-free.metulwx.com   \n",
       "10      https                                 www.gulfshield.com   \n",
       "11       http                                       rodritol.com   \n",
       "12      https                            ecommerce-platforms.com   \n",
       "13      https                                       evercoin.com   \n",
       "14       http                                  www.phishtank.com   \n",
       "15       http                               mawar-abdrahim.co.id   \n",
       "16       http                               jovan.soldatovic.org   \n",
       "17       http                            www.telesport-tv.com.ar   \n",
       "18       http                              pixelpicturescorp.com   \n",
       "19       http                          puertovarasflyfishing.com   \n",
       "20       http                                 www.ortakhatim.com   \n",
       "21       http                                    les-avertis.net   \n",
       "22       http                           www.rileysbrandhoney.com   \n",
       "23       http                                 girlsneedhelp.info   \n",
       "24       http                                        netflix.com   \n",
       "25       http                            mobile-free.metulwx.com   \n",
       "26      https                              commons.wikimedia.org   \n",
       "27      https                                   jobs.jobvite.com   \n",
       "28       http  log-upgrade-helpdata-isetting-data-us.akunnet.com   \n",
       "29       http                            ovodfurnituremakers.com   \n",
       "...       ...                                                ...   \n",
       "1751     http                               mvpl.enkilibrary.org   \n",
       "1752     http                               www.techrepublic.com   \n",
       "1753     http                         naleoserver.3disystems.com   \n",
       "1754    https                   app-1506806908.000webhostapp.com   \n",
       "1755     http                                 stephanehamard.com   \n",
       "1756     http                          www.scuolasci-dolomiti.it   \n",
       "1757     http                         kampanya.qnbfinansbank.com   \n",
       "1758    https                                   apps.shopify.com   \n",
       "1759      NaN                                                NaN   \n",
       "1760     http                             chairnerd.seatgeek.com   \n",
       "1761     http                                      www.sozce.com   \n",
       "1762     http                                    snackenak.co.id   \n",
       "1763     http                                        www.hbo.com   \n",
       "1764     http                                        www.bbc.com   \n",
       "1765     http                                             gu.com   \n",
       "1766     http                                       malomolk.com   \n",
       "1767    https                 goodlogstext4004.000webhostapp.com   \n",
       "1768     http  particuliers.secure.credit-agricole.fr.mtoffic...   \n",
       "1769     http                                      confrecor.org   \n",
       "1770     http                              eltonjohncover.com.br   \n",
       "1771    https                  www.gettingpaidtopayattention.com   \n",
       "1772    https              locking-app-adverds.000webhostapp.com   \n",
       "1773     http                          www.scuolasci-dolomiti.it   \n",
       "1774     http                               www.dpincsupport.com   \n",
       "1775    https                                        bitcoin.org   \n",
       "1776    https                                    docs.google.com   \n",
       "1777     http                                www.charlestodd.com   \n",
       "1778     http                                      tslimpact.com   \n",
       "1779     http                 daoudilorin11.mystagingwebsite.com   \n",
       "1780    https                                          stom05.ru   \n",
       "\n",
       "                                                address is_phished  long_url  \\\n",
       "0     payment-update-0.html?fb_source=bookmark_apps&...        yes         1   \n",
       "1                         wp-includes/js/jquery/ini.php        yes         2   \n",
       "2                                      p/pylevenshtein/         no         0   \n",
       "3                                                               no         0   \n",
       "4                                   f/219/cadir2yr3.jpg         no         0   \n",
       "5     viewer/secure/pdf/oeseuikt874lsab1nd951o2hb6vb...         no         1   \n",
       "6                                         download.html         no         0   \n",
       "7                                                               no         0   \n",
       "8     config/login?.done=https%3a%2f%2fapi.login.yah...         no         1   \n",
       "9                                        mobile/impaye/        yes         0   \n",
       "10    uploads/gallery/mankind/secure/fiscal/manual/m...        yes         1   \n",
       "11                             components/kttm/dropbox/        yes         0   \n",
       "12    articles/top-6-ecommerce-platform-reviews-2012...         no         1   \n",
       "13                                                              no         0   \n",
       "14                                    phish_archive.php         no         0   \n",
       "15                                        kip/spacebox/        yes         0   \n",
       "16    css/google-manual/f6946ab165caf661256632b7502e...        yes         1   \n",
       "17                                      media/index.htm        yes         0   \n",
       "18                                                             yes         0   \n",
       "19                                                 chas        yes         0   \n",
       "20                                 mukabele/106_107.htm         no         0   \n",
       "21                                        mlec/mlec.php        yes         0   \n",
       "22                                online/asb/asb.co.nz/        yes         0   \n",
       "23            docss/file/files/db/file.dropbox/form.php        yes         2   \n",
       "24                                                              no         0   \n",
       "25      mobile/impaye/5739e346002526519df9d8623b9c854b/        yes         1   \n",
       "26    wiki/commons:wiki_loves_monuments_2017_in_the_...         no         1   \n",
       "27    careers/crowdstrike/job/obgg5fwm?__jvst=jobboa...         no         1   \n",
       "28         up/verification/7na1n7878n0b27m71d15/qes.php        yes         1   \n",
       "29                                   wp-yahoo/t/y1.html        yes         0   \n",
       "...                                                 ...        ...       ...   \n",
       "1751                                    myresearch/home         no         0   \n",
       "1752  article/deceptive-networking-lures-hackers-wit...         no         1   \n",
       "1753                     drupal/sites/default/files/ub/        yes         2   \n",
       "1754  public/revery/revery/card.html?wo9spdzhykzcx2h...        yes         1   \n",
       "1755  components/com_joomlastats/fr/b69d7d0348bc9799...        yes         1   \n",
       "1756  includes/usaa/verification/9bd4c1dm321n45805n9...        yes         1   \n",
       "1757  asp/scrunsubscribe.aspx?cmdmkey=404433025&emai...         no         1   \n",
       "1758                         shopify-recurring-payments         no         0   \n",
       "1759                                                NaN        NaN         0   \n",
       "1760        fuzzywuzzy-fuzzy-string-matching-in-python/         no         2   \n",
       "1761                                                            no         0   \n",
       "1762             secure-domains/document/pvalidate.html        yes         2   \n",
       "1763                            silicon-valley/episodes         no         0   \n",
       "1764                                                            no         0   \n",
       "1765              p/76dxv?cmp=share_androidapp_facebook         no         0   \n",
       "1766                                  nab/cardinfo.html        yes         0   \n",
       "1767  recovery-answer.html?=10065877425?fb_source=bo...        yes         1   \n",
       "1768            stb/entreebam/informations-requises.php        yes         1   \n",
       "1769      successs/ssdsss/filessss/filessss/documentss/        yes         2   \n",
       "1770        ftm/ghost/30055bc987091413d1307854d418711f/        yes         2   \n",
       "1771  dl/8ac809f7440c23a2f670e5288c3769d5/my/identit...        yes         1   \n",
       "1772  payment-update-01.html?fb_source=bookmark_apps...        yes         1   \n",
       "1773  includes/usaa/verification/baa9b99a51bd58d62d3...        yes         1   \n",
       "1774                                                            no         0   \n",
       "1775                                                en/         no         0   \n",
       "1776                                      document/u/1/         no         0   \n",
       "1777                       wp-includes/pomo/adobe2.html        yes         2   \n",
       "1778  medsynaptic/wp-content/themes/twentyseventeen/...        yes         1   \n",
       "1779   wp-content/plugins/ubh/acc/dir/68e1c/dir/car.php        yes         1   \n",
       "1780                                          asb.co.nz        yes         0   \n",
       "\n",
       "      having_@_symbol  redirection_//_symbol  prefix_suffix_seperation  \\\n",
       "0                   0                      0                         1   \n",
       "1                   0                      0                         0   \n",
       "2                   0                      0                         0   \n",
       "3                   0                      0                         0   \n",
       "4                   0                      0                         0   \n",
       "5                   0                      0                         1   \n",
       "6                   0                      0                         1   \n",
       "7                   0                      0                         0   \n",
       "8                   0                      0                         0   \n",
       "9                   0                      0                         1   \n",
       "10                  0                      0                         0   \n",
       "11                  0                      0                         0   \n",
       "12                  0                      0                         1   \n",
       "13                  0                      0                         0   \n",
       "14                  0                      0                         0   \n",
       "15                  0                      0                         1   \n",
       "16                  0                      0                         0   \n",
       "17                  0                      0                         1   \n",
       "18                  0                      0                         0   \n",
       "19                  0                      0                         0   \n",
       "20                  0                      0                         0   \n",
       "21                  0                      0                         1   \n",
       "22                  0                      0                         0   \n",
       "23                  0                      0                         0   \n",
       "24                  0                      0                         0   \n",
       "25                  0                      0                         1   \n",
       "26                  0                      0                         0   \n",
       "27                  0                      0                         0   \n",
       "28                  0                      0                         1   \n",
       "29                  0                      0                         0   \n",
       "...               ...                    ...                       ...   \n",
       "1751                0                      0                         0   \n",
       "1752                0                      0                         0   \n",
       "1753                0                      0                         0   \n",
       "1754                0                      0                         1   \n",
       "1755                0                      0                         0   \n",
       "1756                0                      0                         1   \n",
       "1757                0                      0                         0   \n",
       "1758                0                      0                         0   \n",
       "1759                0                      0                         0   \n",
       "1760                0                      0                         0   \n",
       "1761                0                      0                         0   \n",
       "1762                0                      0                         0   \n",
       "1763                0                      0                         0   \n",
       "1764                0                      0                         0   \n",
       "1765                0                      0                         0   \n",
       "1766                0                      0                         0   \n",
       "1767                0                      0                         0   \n",
       "1768                0                      0                         1   \n",
       "1769                0                      0                         0   \n",
       "1770                0                      0                         0   \n",
       "1771                0                      0                         0   \n",
       "1772                0                      0                         1   \n",
       "1773                0                      0                         1   \n",
       "1774                0                      0                         0   \n",
       "1775                0                      0                         0   \n",
       "1776                0                      0                         0   \n",
       "1777                0                      0                         0   \n",
       "1778                0                      0                         0   \n",
       "1779                0                      0                         0   \n",
       "1780                0                      0                         0   \n",
       "\n",
       "      sub_domains  \n",
       "0               0  \n",
       "1               0  \n",
       "2               0  \n",
       "3               0  \n",
       "4               0  \n",
       "5               0  \n",
       "6               0  \n",
       "7               0  \n",
       "8               0  \n",
       "9               0  \n",
       "10              0  \n",
       "11              0  \n",
       "12              0  \n",
       "13              0  \n",
       "14              0  \n",
       "15              0  \n",
       "16              0  \n",
       "17              2  \n",
       "18              0  \n",
       "19              0  \n",
       "20              0  \n",
       "21              0  \n",
       "22              0  \n",
       "23              0  \n",
       "24              0  \n",
       "25              0  \n",
       "26              0  \n",
       "27              0  \n",
       "28              0  \n",
       "29              0  \n",
       "...           ...  \n",
       "1751            0  \n",
       "1752            0  \n",
       "1753            0  \n",
       "1754            0  \n",
       "1755            0  \n",
       "1756            0  \n",
       "1757            0  \n",
       "1758            0  \n",
       "1759            0  \n",
       "1760            0  \n",
       "1761            0  \n",
       "1762            0  \n",
       "1763            0  \n",
       "1764            0  \n",
       "1765            0  \n",
       "1766            0  \n",
       "1767            0  \n",
       "1768            1  \n",
       "1769            0  \n",
       "1770            0  \n",
       "1771            0  \n",
       "1772            0  \n",
       "1773            0  \n",
       "1774            0  \n",
       "1775            0  \n",
       "1776            0  \n",
       "1777            0  \n",
       "1778            0  \n",
       "1779            0  \n",
       "1780            0  \n",
       "\n",
       "[1781 rows x 9 columns]"
      ]
     },
     "execution_count": 45,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splitted_data"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Classification of URLs using Random forest "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 137,
   "metadata": {},
   "outputs": [],
   "source": [
    "from sklearn.ensemble import RandomForestClassifier\n",
    "from sklearn.metrics import confusion_matrix, accuracy_score"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['long_url', 'having_@_symbol', 'redirection_//_symbol',\n",
       "       'prefix_suffix_seperation', 'sub_domains'],\n",
       "      dtype='object')"
      ]
     },
     "execution_count": 70,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#Features\n",
    "x = splitted_data.columns[4:9]\n",
    "x   "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 71,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([0, 0, 1, ..., 0, 0, 0], dtype=int64)"
      ]
     },
     "execution_count": 71,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#variable to be predicted; yes = 0 and no = 1\n",
    "y = pd.factorize(splitted_data['is_phished'])[0]\n",
    "y "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 139,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "RandomForestClassifier(bootstrap=True, class_weight=None, criterion='gini',\n",
       "            max_depth=None, max_features='auto', max_leaf_nodes=None,\n",
       "            min_impurity_decrease=0.0, min_impurity_split=None,\n",
       "            min_samples_leaf=1, min_samples_split=2,\n",
       "            min_weight_fraction_leaf=0.0, n_estimators=100, n_jobs=2,\n",
       "            oob_score=False, random_state=0, verbose=0, warm_start=False)"
      ]
     },
     "execution_count": 139,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Create a random forest Classifier. By convention, clf means 'Classifier'\n",
    "clf = RandomForestClassifier(n_estimators=100,n_jobs=2,random_state=0)\n",
    "\n",
    "# Train the Classifier to take the training features and learn how they relate\n",
    "# to the training y (the species)\n",
    "clf.fit(splitted_data[x], y)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 140,
   "metadata": {},
   "outputs": [],
   "source": [
    "test_data = pd.read_csv(\"dataset3.csv\") "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 141,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0,\n",
       "       0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0,\n",
       "       0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1,\n",
       "       1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1,\n",
       "       0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0,\n",
       "       0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1,\n",
       "       0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0,\n",
       "       0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0,\n",
       "       0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0,\n",
       "       0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0,\n",
       "       0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1,\n",
       "       0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0,\n",
       "       0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0,\n",
       "       0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1,\n",
       "       1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1,\n",
       "       1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0,\n",
       "       0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0,\n",
       "       0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1], dtype=int64)"
      ]
     },
     "execution_count": 141,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "clf.predict(test_data[x]) #testing the classifier on test data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 142,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([[0.        , 0.88800564, 0.11199436],\n",
       "       [0.        , 0.50510239, 0.49489761],\n",
       "       [0.00135046, 0.32367919, 0.67497035],\n",
       "       [0.        , 0.50510239, 0.49489761],\n",
       "       [0.00135046, 0.32367919, 0.67497035],\n",
       "       [0.00135046, 0.32367919, 0.67497035],\n",
       "       [0.        , 0.53582536, 0.46417464],\n",
       "       [0.00135046, 0.32367919, 0.67497035],\n",
       "       [0.00135046, 0.32367919, 0.67497035],\n",
       "       [0.00135046, 0.32367919, 0.67497035]])"
      ]
     },
     "execution_count": 142,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "clf.predict_proba(test_data[x])[0:10] #predicted probability for each class."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Evaluating classifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 143,
   "metadata": {},
   "outputs": [],
   "source": [
    "preds = test_data.is_phished[clf.predict(test_data[x])] #predicted values"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 144,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0    yes\n",
       "0    yes\n",
       "1     no\n",
       "0    yes\n",
       "1     no\n",
       "1     no\n",
       "0    yes\n",
       "1     no\n",
       "1     no\n",
       "1     no\n",
       "Name: is_phished, dtype: object"
      ]
     },
     "execution_count": 144,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "preds.head(10)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 151,
   "metadata": {},
   "outputs": [],
   "source": [
    "actual = pd.Series(test_data['is_phished']) #actual values"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 153,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([[ 94,  80],\n",
       "       [ 64, 152]], dtype=int64)"
      ]
     },
     "execution_count": 153,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "confusion_matrix(actual,preds) "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 148,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "0.6307692307692307"
      ]
     },
     "execution_count": 148,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "accuracy_score(actual,predicted) #accuracy of classifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 149,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[('long_url', 0.3558161646143509),\n",
       " ('having_@_symbol', 0.01220141967534722),\n",
       " ('redirection_//_symbol', 0.005280064350323052),\n",
       " ('prefix_suffix_seperation', 0.570074820674297),\n",
       " ('sub_domains', 0.05662753068568204)]"
      ]
     },
     "execution_count": 149,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#importance of features\n",
    "list(zip(splitted_data[x], clf.feature_importances_))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.1"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}