Phishing Detection Research Trends: From Blacklists to Human-in-the-Loop Systems

Blacklists and rules remain useful because many threats reuse known domains, URLs, senders, or patterns. They are fast and operationally simple.

The limitation is that new or low-volume attacks can appear before a list updates.

URL length, redirect count, final-domain mismatch, punycode, IP hosts, subdomain depth, sender metadata, and email structure can all become risk signals.

These features are explainable, which helps users understand why a link deserves caution.

Research explores classifiers, ensembles, deep learning, transformers, page content, screenshots, language, graph patterns, and reporting loops.

Those directions can be powerful, but production systems must handle data quality, adversarial drift, privacy, latency, explainability, and false positives.

When stakes are high, humans can interpret context that automated systems may not have: vendor history, campaign intent, customer risk, brand exposure, and business process.

A mature workflow combines fast signals with escalation paths.

CheckLink uses practical risk signals, local privacy-first tools, and manual review paths today. Future research-inspired signals are described as planned, not as current production claims.