Paper deep dive

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Unai Agirre, Imanol Jerico, Felipe Castaño, Andrea Venturi, Francesco Zola

Year: 2026Venue: arXiv preprintArea: cs.LGType: PreprintEmbeddings: 71

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 94%

Last extracted: 8/23/2026, 1:30:57 AM

Summary

This study proposes a tree-structured approach to detect phishing template reuse and support attacker attribution by modeling webpages as Document Object Model (DOM) trees. The authors extract structural and content-based features from these trees and apply unsupervised clustering algorithms (DBSCAN, OPTICS, Agglomerative Hierarchical Clustering) to group similar phishing sites. A novel metric, the Level-wise Jaccard Distance Score (LJD), is introduced to evaluate cluster quality. Results indicate that structural representations effectively reveal hidden similarities, enabling the detection of zero-day templates and coordinated campaigns.

Entities (10)

DOM Tree · data-structure · 98%HTML · technology · 98%Level-wise Jaccard Distance Score · metric · 97%Phishing Template · concept · 96%Agglomerative Hierarchical Clustering · algorithm · 95%DBSCAN · algorithm · 95%OPTICS · algorithm · 95%Zero-day templates · concept · 93%PhishStats · data-source · 92%Aljofey et al. · author · 90%

Relation Signals (8)

DOM Tree → usedfor → Phishing Template Detection

confidence 95% · We model webpages as Document Object Model (DOM) trees and extract structural features... to identify phishing template reuse.

Level-wise Jaccard Distance Score → usedfor → Cluster Quality Evaluation

confidence 95% · cluster quality is also evaluated both quantitatively... including a novel level-wise Jaccard Distance Score

Unsupervised Learning → enables → Zero-day Template Detection

confidence 93% · enabling the detection of emerging and zero-day templates

HTML Structure → servesas → Robust Fingerprint

confidence 92% · investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse.

OPTICS → evaluatedin → Phishing Analysis

confidence 90% · Three clustering algorithms are evaluated and compared... OPTICS... addresses this limitation

Agglomerative Hierarchical Clustering → evaluatedin → Phishing Analysis

confidence 90% · Three clustering algorithms are evaluated and compared... Agglomerative Hierarchical Clustering (AHC)

DBSCAN → evaluatedin → Phishing Analysis

confidence 90% · Three clustering algorithms are evaluated and compared... DBSCAN... forms clusters

PhishStats → →

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

67,994 characters extracted from source content.

Expand or collapse full text

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis Unai Agirre ∗ , Imanol Jerico ∗ , Felipe Castano ∗† , Andrea Venturi ∗ , Francesco Zola ∗ ∗ Digital Security Department, Vicomtech (BRTA), Donostia / San Sebastian, Spain † University of Le ́ on, Le ́ on, Spain uagirre, ijerico, fcastano, aventuri, fzola@vicomtech.org Abstract—Phishing remains a persistent and evolving cyberse- curity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which en- able cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Doc- ument Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats. Index Terms—Phishing Template, Structural Analysis, At- tacker Attribution, Clustering, DOM analysis, Tree extraction I. INTRODUCTION Phishing remains a persistent and evolving threat within the cybersecurity landscape, maintaining its efficacy despite user awareness. According to the Anti-Phishing Working Group (APWG) [1], attack volumes reached record levels in early 2025, with over 1 million unique phishing attacks detected in the first quarter alone, the highest volume observed since late 2023. This resurgence is characterized by a high degree of sector-specific targeting; the Software as a Service (SaaS) and Webmail category remains the most frequently attacked sector (17.6%), while the financial and payment industries combined account for over 30.9% of all observed incidents. These numbers underscore a broader trend: phishing is no longer a collection of isolated fraudulent events but a massive, industrialized operation that continues to scale across global infrastructures [2]. Traditional defense mechanisms primarily focus on identify- ing individual malicious instances through reactive blocklists or supervised machine learning models [3]. While these ap- proaches achieve high performance in binary classification [4], [5], they remain limited in their ability to provide adversarial insight, as they fail to capture the broader context of attack infrastructures or the structural signatures left by organized actors. This limitation is increasingly relevant, as the prolifer- ation of phishing kits, reusable templates, and web components [6], [7], [8] enables adversaries to deploy numerous fraudulent pages rapidly with minimal effort [2]. In these cases, phishing instances may vary in their domain names or superficial visual elements [9], but they frequently retain a congruent internal architecture. For this reason, the primary objective of this study is to evaluate whether the HTML structure of a webpage serves as a sufficiently robust fingerprint for identifying similarities among malicious sites, thereby providing a stable indicator of phishing structural logic and enabling the detection of systematic template reuse across malicious websites. Specifically, to do this, the proposed methodology uses Document Object Model (DOM) information to build a par- ent–child tree. Then, tree properties (structural information) are used exclusively and combined with content-based data (HTML tags within the DOM) to feed unsupervised learning techniques that cluster similar samples without the need for prior labeling. Finally, once groups of similar trees are gener- ated, the methodology proposes a quantitative and qualitative validation. The first is achieved by introducing a new metric based on level-wise Jaccard Distance Score, while the second is performed manually using dedicated graph/tree visualization tools. By focusing on revealing structures rather than isolated events, this framework offers the adaptability necessary to identify emergent, zero-day phishing templates that evolve continuously to evade static or supervised detection rules. Once identified, these templates form the foundation for the comprehensive characterization and attribution of coordinated phishing campaigns. Summarizing, the main contributions of this study are: • Validate if tree-based representation of phishing web- pages derived from DOM can be used for detecting structural templates; arXiv:2608.16158v1 [cs.LG] 17 Aug 2026 • Compare the performance of three different cluster- ing methodologies when tree properties (structural) are used solely or combined with content-based information (HTML tags); • Validate how the depth of the tree, i.e., the number of nested levels, affects clustering performance; • Define and validate a new level-wise Jaccard Distance Score to evaluate clustering performance (quantitative validation). The remainder of this article is structured as follows. Section I provides the theoretical background and reviews the state-of-the-art relevant to the proposed approach. Section I outlines the methodology, while Section IV details the dataset, experiments, and model configurations. Section V reports the results, while Section VI presents qualitative insights, limita- tions, and ethical concerns. Finally, Section VII concludes the study and suggests potential avenues for future research. I. BACKGROUND A. Clustering The goal of this work is to detect and group phishing templates that exhibit similar structural patterns. To achieve this, clustering algorithms are used as the main analytical tool, since they enable the identification of latent relationships between webpages without requiring prior labels. Among the different clustering paradigms, this study fo- cuses on density-based and hierarchical approaches. Density- based methods are suitable for phishing analysis because they can identify groups with arbitrary shapes while also separating isolated samples that may correspond to structural outliers. Hierarchical methods provide a complementary perspective by organizing samples according to nested similarity relation- ships. Together, these two families of methods make it possible to capture diverse similarity patterns, which is particularly important in a phishing ecosystem characterized by template reuse, campaign variation, and heterogeneous construction strategies [10], [11]. Among density-based methods, DBSCAN (Density-Based Spatial Clustering of Applications with Noise) [12] forms clusters by connecting neighbouring samples that satisfy two conditions: a maximum neighbourhood distance ε and a mini- mum number of points min samples to form a cluster. Its main advantages are that it does not require the number of clusters to be specified in advance and that it can identify noise or isolated samples. However, its performance is sensitive to the choice of ε and may decrease when clusters have different densities. OPTICS (Ordering Points To Identify the Clustering Structure) [13] addresses this limitation by producing an ordering of the samples that reflects their density-based connectivity. This makes it more suitable for data with varying density levels, although the resulting ordering must still be interpreted or converted into final clusters. Agglomerative Hierarchical Clustering (AHC) [14] follows a bottom-up strategy, where each sample initially forms its own cluster and the most similar clusters are progressively merged according to a linkage criterion. This process produces a hierarchy of nested groups, allowing the data to be examined at different levels of granularity. AHC does not necessarily require a predefined number of clusters, depending on the chosen stopping criterion. However, once two clusters are merged, the decision cannot be reversed, and the final structure can be sensitive to the selected distance measure and linkage criterion. B. Related Work Phishing Analysis is divided into two complementary groups [15]. On the one hand, the first kind of approaches treats phishing detection as a binary classification problem, prioritizing the immediate identification and mitigation of malicious instances to protect the end-user. On the other hand, the second approach focuses on post-detection anal- ysis, using confirmed phishing samples to extract structural patterns, common infrastructures, and forensic markers. This second perspective shifts the objective from simple filtering to the characterization of phishing templates and the potential attribution of adversarial groups. The following sections detail the technical evolution of both methodologies. 1) Phishing Detection as Binary Classification: This re- search group focuses on the development of computationally efficient and robust architectures to distinguish between legit- imate and malicious entities. One of the highlight approaches is that proposed by Otieno et al. [16]. In this approach, the authors use semantic analysis to eliminate manual feature engi- neering, demonstrating that bidirectional Transformers (BERT) capture contextual representations of URL strings, achieving 96% accuracy. To address the trade-off between efficiency and robustness, hybrid ensemble systems have been proposed to integrate BERT-derived vectors with stacked classifiers and technical parameters like SSL validity, achieving accuracies up to 98.6% [17], [18]. Beyond URL analysis, Asiri et al. [4] introduced Phish- Transformer, an approach that examines the HTML web page source as complementary information to identify sophisticated threats. The authors use CNNs and Transformers to analyze embedded URL links within the HTML content, addressing the limitations of traditional systems that rely solely on the primary URL. Experimental results on a balanced dataset of 50,000 samples demonstrated that PhishTransformer achieves an average accuracy of 98.9% and an F1-score of 99%. Later, Jiang et al. [5] developed D-PhishNet, employing Graph Attention Networks (GATs) to fuse URL and HTML fea- tures dynamically. The authors introduced the Dual-Branch Alignment Mixer (DBA-CMixer), which uses gated fusion and channel attention to integrate structural URL data with latent semantic features extracted via a pre-trained BERT module to address the “semantic gap” inherent in multi-feature fusion. The authors report an accuracy of up to 99.30%. While binary classification models achieve high perfor- mance in isolating malicious samples, they remain limited in their ability to provide adversarial insight. By focusing strictly on the categorization of isolated events, these methods fail to capture the broader context of the attack infrastructure or the underlying relationships between samples. Given that our research focus is the analysis of patterns within attacks to detect authorship and phishing templates, traditional binary models are insufficient for identifying the systemic signatures left by organized actors. 2) Phishing Template Analysis: Another group focuses on analyzing confirmed phishing samples to identify templates and shared patterns. Nguyen et al. [19] proposed identifying structural clones of legitimate pages by calculating similarity between DOM trees using genetic algorithms, achieving a 0% false-negative rate at specific thresholds. While achieving high accuracy at a threshold of δ = 0.6, the method remains sensitive to obfuscation and exhibits a significant trade-off between false positives and negatives depending on threshold calibration. Unlike this approach, which seeks to identify a phishing site by its proximity to a legitimate target, our research shifts the focus from victim-mimicry detection toward uncovering latent structural links and shared indicators across diverse phishing attacks to characterize broader patterns. To bridge the gap between active attacks and their gen- erative sources, Casta ̃ no et al. [7] introduced PhiKitA, a dataset specifically designed to link phishing kits directly to their deployed website counterparts. Their analysis employed graph representation of the HTML DOM, MD5 hashing, and structural fingerprints to identify familiarity among samples, successfully uncovering a coordinated campaign involving 172 distinct attacks against a single financial institution. The graph- based approach achieved high performance in binary detection tasks (92.5% accuracy). While the findings demonstrated that structural HTML data is critical for tracing the lineage of phishing operations, the reliance on known kit repositories highlights a dependency that limits detection to documented sources. In contrast, the methodology proposed in this work uses unsupervised clustering of web pages, which does not require a prior sample of detected phishing templates. By operating independently of kit-specific metadata, this approach enables the identification of zero-day samples and emergent templates that remain undocumented in existing repositories. As mentioned earlier, the nature of templates detection involves extracting patterns across heterogeneous file types and different attack vectors, which interferes with the use of supervised learning methods due to the lack of annotated datasets. Consequently, unsupervised methodologies are re- quired to discover latent relationships without prior labeling. Althobaiti et al. [20] addressed this by evaluating Mean Shift and DBSCAN algorithms to group corporate email threats, demonstrating that Mean Shift achieves 82% precision in assigning samples to representative clusters based on URL and origin metadata. Although this approach uses email corpora rather than raw HTML, the underlying methodology aligns with current research objectives; the unsupervised nature of the framework provides critical adaptability to emergent templates that constantly evolve to evade static detection rules. I. METHODOLOGY The main goal of this methodology is to analyse and validate structural similarity among phishing webpages. In this sense, the methodology leverages DOM information to build a tree- based representation and then extracts structural and content- based features to assess similarities among phishing webpages. In this way, the process enables the identification of pages that are likely (i) deployed by the same attacker or (i) created using the same template or phishing kit. The proposed methodology comprises four main steps: data preprocessing, tree construction, feature extraction & clustering, and validation. A. Phase 1: Data Preprocessing The experimental evaluation of the proposed methodology uses the dataset developed by Aljofey et al. [21], specifically the subset identified as DS-2. This dataset was selected for its inclusion of full HTML source code, which is an essen- tial requirement for the tree-based representation described in Phase 2. Collected during 2023 and published in 2025, the corpus captures current evasion tactics and modern web design patterns, thereby serving as a benchmark for structural analysis. Phishing samples were collected from PhishStats and validated between July 15 and August 9, 2023. Legitimate instances were sourced from Alexa top-ranked websites as of November 2023. From the complete dataset, this study focuses exclusively on phishing instances, discarding legitimate sam- ples as noise for the specific scope of this research. During preprocessing, the remaining samples are thoroughly cleaned by removing duplicate records and incomplete data. <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>My Website - Home</title> </head> <body> <header> <h1>Welcome to My Website</h1> <nav> <a href="index.html">Home</a> | <a href="about.html">About</a> | <p> Example Home </p> </nav> </header> <main> <h1>Home Page</h1> <p>This is the homepage of a simple multi-page HTML website.</p> </main> </body> </html> HTML HEAD BODY METATITLE HEADERMAIN H1_1NAV H1_2 P A_2 A_1 P 0-level 1-level 2-level 3-level 4-level HTML source code Tree Extraction Fig. 1: Example of a tree extracted from an HTML DOM. B. Phase 2: Tree Construction Starting from the HTML content of phishing pages, the first phase of the proposed methodology consists of constructing a tree-based representation of their DOM. The objective is to preserve the hierarchical structure of the original document by representing each HTML element (or tag) as a node in the tree. In this representation, nodes correspond to individual HTML tag, while edges capture the parent–child relationships between elements. More specifically, an edge connects a parent node to a child node when the corresponding HTML tag is nested within another tag in the original document, as shown in Figure 1. This representation allows the construction of a tree with varying depths, according to the nesting structure of the DOM. Each depth in the tree defines a level. Thus, webpages share a common top-level DOM structure, where the root node (0- level) corresponds to the <html> element and its immediate children (1-level) correspond to the <head> and <body> elements. To prevent node collision when identical tags appear multi- ple times at the same hierarchical level, each node receives a unique identifier comprising the tag name, depth level, local child index, and a cumulative traversal counter. C. Phase 3: Feature Extraction & Clustering Once the trees have been generated, this phase focuses on extracting structural and content-based parameters to char- acterize each individual tree. More specifically, the study considers two complementary groups of features. The first group relies on 5 structural properties of the tree, reported in Table I. These features capture the overall shape and complexity of the tree. On the other hand, the second group extends this structural description by incorporating content- based information, that are the occurrence of the HTML tags observed at each level of the DOM tree (their distribution across the hierarchy). Thus, the following 22 HTML tags are used: form, input, button, a, iframe, script, img, link, meta, div, span, label, style, title, svg, section, picture, ul, li, nav, g, p. These elements are selected for their relevance in phishing threat since their are commonly associated with credential collection interfaces, embedded external resources, page layout, and client-side be- havior. By integrating this tag-level information, the resulting representation preserves not only the structural arrangement of nodes but also the semantic role of the elements composing the tree. Thanks to this feature extraction process, trees are converted into numerical vectors that provide a compact yet informative representation of webpages, enabling objective mathematical comparisons and aggregation. Thus, clustering algorithms are applied to group webpages exhibiting similar structural and content-based characteristics, allowing for the identification of latent patterns and templates that may not be immediately apparent through manual inspection. D. Phase 4: Validation In this fourth phase, the groups generated by the clustering algorithms are evaluated both quantitatively and qualitatively. Specifically, in the first case, a dedicated metric based on Jac- card distance is used, while in the second case, representative samples are visually inspected for the final evaluation. Quantitative Validation. In this step, to compare the performance of the clustering algorithms, a metric based on the level-wise Jaccard comparison of HTML tag-frequency distributions is used. We refer to this metric as the Level-wise Jaccard Distance Score (LJD). The proposed metric evaluates cluster quality by measuring whether samples within the same cluster exhibit similar distributions of HTML tags across DOM levels, while samples assigned to different clusters remain sufficiently dissimilar. First, for each pair of samples (x,y) and for each DOM level l, both samples are represented by tag-frequency coun- ters. Specifically, c x,l (t) and c y,l (t) denote the number of occurrences of tag t at level l in samples x and y, respectively. The level-wise Jaccard similarity is computed as: J l (x,y) = P t∈T l min(c x,l (t),c y,l (t)) P t∈T l max(c x,l (t),c y,l (t)) (1) where the numerator represents the shared tag occurrences between the two samples at level l, while the denominator represents the total tag occurrences after combining both samples, computed through the maximum tag counts. The level-wise similarities are then combined through a weighted average: LJ (x,y) = X l∈L w l ·J l (x,y),with w l = 1 l P k∈L 1 k (2) where L denotes the set of DOM levels considered in the comparison. In this work, the first two DOM levels are not considered, since they usually correspond to the common top- level structure of HTML documents. The remaining levels are weighted according to their depth, assigning larger weights to upper levels and lower weights to deeper levels. This weighting scheme reflects the intuition that differences in higher DOM levels are more relevant for identifying changes in the global structure of a webpage, whereas differences in deeper levels are more likely to correspond to local variations, nested layout details, or minor implementation differences. Since LJ (x,y) defines a similarity score, it is converted into a distance as follows: LJD(x,y) = 1−LJ (x,y)(3) This transformation preserves the usual interpretation of distance-based cluster validation: small distances indicate similar samples, whereas large distances indicate dissimilar samples. Let P A = C 1 ,C 2 ,...,C K be the partition generated by a clustering algorithm A, where K is the number of clusters produced by the algorithm. For each cluster C i , it is possible to compute its internal compactness (the intra metric) using Equation 4, i.e., the average distance between unordered pairs of distinct samples within C i . Likewise, it is possible to compute the degree of separation between a cluster and all the others (the inter metric), i.e., the average distance between samples belonging to different clusters, as shown in Equation 5. This latter metric yields an array of distances for each cluster. Therefore, for each C i they can be aggregated into a single value, denoted by LJD inter , as shown in Equation 6. LJD intra (C i ) = 1 |C i | 2 X x,y∈C i x<y LJD(x,y)(4) FeaturesDescription 1Number of nodesIt represents the total count of HTML elements within the pruned DOM tree, indicating the overall structural complexity of the web page. 2Number of edgesIt quantifies the total hierarchical and relational links between elements. A high edge-to-node ratio often suggests a more complex layout. 3Maximum centralityIt identifies the most interconnected node in the graph. In phishing, this often corresponds to a central container or a critical form element [22]. 4Minimum centralityIt measures the lowest degree of connectivity, helping to identify peripheral elements or isolated scripts often used for obfuscation [22]. 5Centrality on averageThis feature provides a global measure of structural importance across all elements, capturing the general density of the page’s architecture [23]. TABLE I: List of structural properties extracted from the tree. LJD inter (C i ,C j ) = 1 |C i ||C j | X x∈C i X y∈C j LJD(x,y), i̸= j (5) LJD inter (C i ) = 1 K− 1 K X j=1 j̸=i LJD inter (C i ,C j )(6) Using equation 7, intra and inter metrics can be finally com- bined to generate an unique value for each cluster (LJD(C i )), where small values indicate that cluster C i is internally compact and well separated from the remaining clusters. Conversely, high values indicate that the internal dispersion of the cluster is large relative to its separation from the rest of the partition. LJD(C i ) = LJD intra (C i ) LJD inter (C i ) (7) The LJD A (Level-wise Jaccard Distance Score associated with algorithm A) is defined as a vector containing each LJD(C i ) for all the C i ∈P A , as detailed in Equation 8. LJD A = [LJD(C 1 ),LJD(C 2 ),...,LJD(C K )](8) Finally, to summarize the behaviour of each clustering algorithm, three descriptive statistics are computed over the elements of the vector LJD A : the mean (LJD A mean ), the standard deviation (LJD A std ), and the maximum value (LJD A max ). Yet, LJD A mean provides an overall estimate of cluster quality, the LJD A std measures the variability of the cluster-level scores, and theLJD A max identifies the most prob- lematic cluster generated by the algorithm. AsLJD intra (C i ) is not defined for singletons (i.e., clusters with just one element), we do not consider them for the LJD A mean and LJD A std computations. It should be noted thatLJD A differs from standard feature- space clustering metrics. Rather than evaluating the clustering partition directly on the normalized feature vectors used by the clustering algorithms, it is computed from the extracted DOM- tree representations by comparing the level-wise distributions of HTML tags. Therefore, its interpretation plays a key role in the cluster evaluation, providing a DOM-level validation criterion complementary to standard feature-space clustering metrics. Qualitative Validation. In this case, due to the high number of groups generated by the clustering algorithms, only N representative clusters are considered, as shown in step 2 in Figure 2. Specifically, the N most compact are selected, i.e., those with the lowestLJD intra values. Then, they are visually inspected through their cluster medoids. Medoid Evaluation. For each of the selected N compact cluster, the sample with the minimum average LJD to the other elements of the same cluster is identified as the cluster medoid (step 3 in Figure 2). These medoids are then visually compared across the selected clusters to assess whether they provide representative and distinguishable structural patterns. Specifically, the graphs are analysed and visualised using the Gephi tool [24]. Then, to obtain a more comprehensive view of the selected groups, C additional samples within each considered cluster are selected and compared with their medoid to assess consistency within each cluster (step 4 in Figure 2). s Fig. 2: Schema of the qualitative validation steps followed during the analysis. IV. EXPERIMENTAL STUDY A. Dataset The experimental evaluation of the proposed methodology uses the dataset developed by Aljofey et al. [21], specifically the subset identified as DS-2. This dataset was selected for its inclusion of full HTML source code, which is an essential re- quirement for the tree-based representation described in Phase 1. Collected during 2023 and published in 2025, the corpus captures current evasion tactics and modern web design pat- terns, thereby serving as a benchmark for structural analysis. The dataset contains 23,366 samples, including 8,366 phishing instances and 15,000 legitimate instances. Phishing samples were collected from PhishStats 1 and validated between July 15 and August 9, 2023. Only the sub-corpus of 8,366 phishing pages is used in this study, as the primary objective is the structural analysis and clustering of phishing threats to identify recurrent attack patterns. B. Experiment setup As mentioned earlier, each webpage can generate a tree with different depth, depending on the number of nested elements. In order to provide a more comprehensive view of similarity, this study investigates how the number of considered lev- els can affect the clustering task. In particular, varying the depth of the extracted DOM representation may influence both the structural detail captured and the resulting similarity between webpages. For this reason, eight different depths are considered and compared, ranging from 8 to 15 levels. This range is chosen to balance representational completeness and computational efficiency, ensuring that both shallow and deep structural information are evaluated. Specifically, for each maximum level selected, if a webpage has a deeper tree, it is pruned to the maximum fixed depth. If a sample has fewer levels, the missing-level (tags) information is set to 0. For the qualitative analysis, the parameters N and C must be fixed. In this study, the number of representative compact clusters is set to N = 3, while the number of additional samples per cluster is set to C = 2. Furthermore, to ensure a meaningful and reliable validation, only clusters containing more than 4 elements are considered in the qualitative analysis. This filtering step excludes clusters that, although potentially relevant, do not contain a sufficient number of samples to sup- port a representative visual inspection and robust qualitative assessment of compact consistency. As a result, the analysis focuses on clusters with adequate cardinality, reducing the risk of drawing conclusions from sparsely populated or statistically unstable groups. C. Model configurations To obtain a broader view of the clustering performance, the results of three different algorithms are compared. Specifically, two density-based methods (DBSCAN and OPTICS) and one hierarchical method (Agglomerative-AHC) are used. Never- theless, as introduced in Section I-A, these algorithms require 1 https://w.phishstats.info/ the tuning of specific parameters. Thus, for both density-based methods, a grid-search mechanisms is implemented varying the ε (or xi) and min_samples parameters, while different distance thresholds are used for hierarchically-based method, as reported in Table I. To evaluate the performance of the clustering algorithms and perform the grid search analysis, state-of-the-art metrics are considered [25], such as the Silhouette Coefficient (S score ), the Calinski-Harabasz Index (CH index ) and the Davies-Bouldin Index (DB index ). These metrics are mainly used during grid search to identify the best configuration for each algorithm at each considered level of the analysis. Yet, the search approach is initially applied using only the structural properties of the tree, and then combining also content-based features, as detailed in Section I-C. Notably, during the search task, the introduced metric (LJD) is not used, as the analysis prioritizes established and well-validated metrics. Thus, once best configurations are detected, they are further validated using quantitative and qualitative approaches. AlgorithmsParameterValues DBSCAN ε0.1, 0.2,..., 1.0, step=0.1 min_samples2, 3, 5, 8, 10 OPTICS xi0.1, 0.2,..., 1.0, step=0.1 min_samples2, 3, 5, 8, 10 AHCt5, 25, 50, 75, 100 TABLE I: Grid search parameters for clustering algorithms. V. RESULTS A. Grid-search results The results of the clustering algorithms during the search phase are reported in Figures 3, 4, and 5. Specifically, for simplicity, the analysis reports only the S score , used as the performance-driven metric to detect the best configuration. Then, for the best configuration obtained at each level, the corresponding CH index and DB index values are further de- tailed in the next section. However, this section shows only the results obtained when structural features are used. The same grid-search analysis is also repeated using both structural and content-based features, and the results of this second case are reported in Appendix A. Figure 3 reports the DBSCAN performance, demonstrating a consistent behavior of the algorithm across most tree depths. In fact, the highest S score is obtained for a fixed value of ε = 0.6 at almost all levels (8, 9, 11, 12, and 13). Deviations from this pattern occur only at levels 10 and 14, where the peak shifts toward lower-density configurations despite maintaining ε = 0.6. At level 15, however, the maximum S score is achieved when the neighborhood radius decreases to ε = 0.5. Considering the min_samples parameter, the highest scores are generally obtained with larger values (min_samples = 8 or 10) across all levels except level 10, where the optimal min_samples decreases to 3. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .125.014.188.352.325.531.381.486.495.495 .102.205.205.350.438.531.381.486.495.495 .166.257.294.447.450.540.390.486.495.495 .244.271.419.418.449.525.373.500.501.496 .200.297.417.418.449.545.399.500.501.501 0.0 0.2 0.4 0.6 0.8 1.0 (a) Level 8. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .102.109.157.277.406.487.329.362.360.360 .122.249.178.276.427.536.392.493.499.499 .078.303.287.435.439.534.384.494.499.499 .090.253.374.456.467.532.384.494.494.495 .178.282.369.456.489.556.395.495.494.495 0.0 0.2 0.4 0.6 0.8 1.0 (b) Level 9. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .164.067.122.227.393.461.300.310.502.502 .213.154.138.225.417.546.401.501.501.501 .158.240.271.427.271.544.394.505.506.506 .221.044.372.436.478.543.394.508.508.506 .199.326.358.467.470.543.392.508.508.507 0.0 0.2 0.4 0.6 0.8 1.0 (c) Level 10. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .091-.034.134.238.237.431.257.497.497.497 .122.108.129.240.240.544.391.497.497.497 .165.222.199.471.475.544.398.504.504.504 .173.278.379.442.473.556.391.495.504.504 .257.314.352.442.473.538.404.493.504.504 0.0 0.2 0.4 0.6 0.8 1.0 (d) Level 11. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .166.066.131.216.214.398.231.245.496.496 .244.106.130.219.217.539.389.495.496.496 .228.219.272.472.470.541.394.500.500.501 .213.276.383.453.484.552.390.500.500.501 .230.308.379.431.484.552.400.489.501.501 0.0 0.2 0.4 0.6 0.8 1.0 (e) Level 12. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .112.155.151.212.354.377.209.222.498.498 .166.153.151.213.453.542.389.495.500.500 .190.216.269.472.484.536.399.504.504.502 .221.211.383.444.485.552.401.505.505.504 .164.320.385.444.476.553.401.505.506.505 0.0 0.2 0.4 0.6 0.8 1.0 (f) Level 13. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .166.152.108.200.335.361.189.199.499.498 .222.182.136.201.459.540.393.496.498.498 .168.265.259.471.554.555.402.507.498.498 .237.258.352.440.554.555.402.507.507.507 .177.296.347.466.538.555.403.508.507.507 0.0 0.2 0.4 0.6 0.8 1.0 (g) Level 14. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .225.064.110.182.330.349.176.499.503.502 .271.147.106.181.466.547.395.498.502.506 .284.251.254.481.542.546.395.497.509.507 .228.263.307.468.563.562.410.512.498.508 .161.291.303.468.565.562.410.512.512.497 0.0 0.2 0.4 0.6 0.8 1.0 (h) Level 15. Fig. 3: DBSCAN S score during the grid-search using only structural features. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .782.762.745.720.690.666.651.642.641 .655.615.577.547.512.485.472.469.469 .549.455.396.366.338.328.322.322.322 .403.330.291.266.252.252.251.251.251 .344.264.240.218.208.208.208.208.208 0.0 0.2 0.4 0.6 0.8 1.0 (a) Level 8. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .773.749.730.707.671.642.623.615.612 .646.598.564.528.485.464.448.444.442 .488.423.389.343.309.296.295.297.297 .435.333.263.235.223.221.220.220.220 .373.274.222.208.193.184.184.184.184 0.0 0.2 0.4 0.6 0.8 1.0 (b) Level 9. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .765.742.717.694.655.628.601.592.590 .641.606.571.524.480.455.437.429.427 .493.423.383.329.295.286.281.281.281 .375.295.259.222.205.204.204.203.203 .349.260.204.185.174.174.173.173.173 0.0 0.2 0.4 0.6 0.8 1.0 (c) Level 10. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .766.744.720.690.654.617.598.588.584 .629.585.542.502.453.439.424.422.420 .490.419.349.323.291.282.271.269.267 .392.306.240.217.207.197.195.195.195 .357.266.207.199.168.168.166.166.166 0.0 0.2 0.4 0.6 0.8 1.0 (d) Level 11. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .765.741.713.686.648.611.589.576.571 .631.587.540.500.455.428.408.403.401 .485.397.353.294.271.265.262.260.258 .387.272.237.213.199.192.192.192.192 .338.252.191.179.165.161.161.161.161 0.0 0.2 0.4 0.6 0.8 1.0 (e) Level 12. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .755.736.708.681.647.610.580.569.564 .615.572.532.489.458.428.402.391.389 .473.379.338.291.271.261.252.250.250 .391.300.259.221.194.194.193.192.192 .366.243.209.179.155.155.154.154.154 0.0 0.2 0.4 0.6 0.8 1.0 (f) Level 13. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .762.739.712.676.647.613.582.565.558 .618.578.540.490.444.419.394.386.382 .482.398.347.301.264.258.254.252.253 .388.299.251.223.208.203.192.191.191 .360.259.194.181.161.158.157.154.154 0.0 0.2 0.4 0.6 0.8 1.0 (g) Level 14. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .767.742.708.679.645.612.578.562.555 .631.590.531.490.450.425.397.385.380 .465.407.356.312.270.260.255.249.247 .373.313.264.227.205.200.192.192.191 .331.243.206.179.149.147.147.147.146 0.0 0.2 0.4 0.6 0.8 1.0 (h) Level 15. Fig. 4: OPTICS S score during the grid-search using only structural features. Figure 4 shows the OPTICS performance, highlighting that, across all pruning stages, the highest value is invariably achieved with the lowest density value (min_samples= 2). Conversely, looking at the xi parameter, it concentrates at 0.1 in all stages excluding level 10, whereas the xi value increases to 0.2. AHC grid-search results are reported in Figure 5. Specifi- cally, the figure shows consistent behavior in the algorithm performance, indicating that across all levels, the highest S score is achieved with the same threshold t = 75. B. Structural and content-based features contribution analysis Once the best configurations are identified through the grid- search analysis conducted in Section V-A (and Appendix A), the clustering metrics presented in Section IV-C for each algorithm across all structural depths are summarized in Table I. Specifically, the first table reports the results when only structural properties are used, while the latter reports the results when content-based information is also included. As shown in Table IIIa, OPTICS achieves the highest perfor- mance according to S score , obtaining values greater than 0.75 DBSCANOPTICSAHC Level N c N o% S score DB index CH index N c N o% S score DB index CH index N c S i% S score DB index CH index 871.04%0.5450.4847325517.34%0.7821.6962930.0%0.6250.5753,487 970.91%0.5560.4647785667.34%0.7731.6054530.0%0.6280.5693,376 10100.20%0.5460.9246505677.11%0.7651.44818130.0%0.6560.5663,435 1170.68%0.5560.4927875746.89%0.7661.50219130.0%0.6380.5683,558 1270.68%0.5520.4617865836.86%0.7651.54517230.0%0.6060.6223,457 1370.63%0.5530.4447925787.50%0.7551.52511430.0%0.6500.6003,828 1470.52%0.5550.4757945917.07%0.7621.5769640.0%0.6630.4324,450 1571.04%0.5650.5597535936.66%0.7671.54713240.0%0.6700.5213,696 (a) Only structural properties results. DBSCANOPTICSAHC Level N c N o% S score DB index CH index N c N o% S score DB index CH index N c S i% S score DB index CH index 828720.64%0.5911.9088.6343420.53%0.6391.9817.2190065.22%0.7150.3161,455 929321.82%0.5831.9447.7746323.77%0.5571.8206.2394466.84%0.7110.2921,661 1029522.00%0.5811.9967.2246824.15%0.5502.0155.8096668.12%0.7070.2851,879 1129922.32%0.5812.0566.6748623.77%0.5442.0665.5899269.25%0.7070.2652,173 1229822.72%0.5722.0566.7042329.63%0.4882.0005.171,00969.87%0.7030.2552,387 1330223.24%0.5682.0746.2138926.26%0.5712.0745.321,02869.46%0.7070.2472,532 1430923.58%0.5612.0966.1042423.95%0.5982.1585.261,04769.34%0.7070.2472,708 1530723.81%0.5592.1386.0348927.57%0.4882.0904.801,06269.77%0.7060.2432,956 (b) Structural and content-based properties results. TABLE I: Metrics of the best configuration of each algorithms for each level. N c indicates the number of generated clusters; N o% the number of samples in percentage clustered as noisy points; S i% the number of cluster in percentage that have only one sample within. For each metric and each algorithm, the best metric value is shown in bold, while the model selected as the best performer is highlighted in yellow. 5.025.050.075.0100.0 threshold 8 9 10 11 12 13 14 15 level .606.512.433.625.625 .580.508.493.624.628 .567.493.515.655.656 .573.460.485.638.638 .554.495.551.606.606 .578.494.538.650.650 .579.497.533.663.663 .582.552.501.667.670 0.0 0.2 0.4 0.6 0.8 1.0 Fig. 5: AHCS score during the grid-search using only structural features. across all eight evaluated levels. However, it performs worst with respect to DB index and CH index . In contrast, DBSCAN and AHC achieve lower DB index values, while AHC also attains higherCH index values. Yet, OPTICS yields a relatively large number of clusters and a higher proportion of outliers (N o% ∈ [6.66%, 7.34%]). On the other hand, DBSCAN and AHC produce only a few clusters: the DBSCAN with very low proportions of outliers (≤ 1.04%); and the AHC with no singletons (clusters with just one element). When content-based features are incorporated into the clus- tering process, two distinct behaviors are observed (Table IIIb). On the one hand, OPTICS exhibits a marked deterioration in clustering performance, reflected by higher DB index val- ues and lower S score and CH index values. In addition, the proportion of outliers increases considerably, ranging from approximately 20% to 32%. Similarly, DBSCAN exhibits poorer performance in terms of DB index and CH index , while itsS score values slightly increased compared to those observed in the previous case. (Table IIIa). Furthermore, DBSCAN is now able to generate a considerable number of clusters (N c > 286), albeit with a higher proportion of outliers (approximately 20-24%). On the other hand, AHC shows improvements in in S score and DB index , with an increase of 0.046 and a decrease of 0.189 in their best values, respectively. Yet, AHC now produces approximately 65–70% of clusters containing a single element. A comprehensive analysis of Table I reveals that the algorithms do not consistently achieve their best performance at a single configuration level. In fact, only in four cases do they achieve at least two best metrics at the same level, namely structural AHC at level 14, content-based DBSCAN at level 8, content-based OPTICS at level 8, and content- based AHC at level 15. In the remaining cases, the final level selection was based on a holistic assessment of all three metrics, prioritizing the overall trade-off among them rather than the best performance in any single metric. Looking at these insights and the extracted level informa- tion, the results show that, when considering only structural properties, all the models perform better with a higher num- ber of levels within the trees (14, 11, and 14). However, when content-based information is incorporated, DBSCAN and OPTICS tend to perform better with fewer levels (just 8). These results are somewhat expected since the content-based AlgorithmsFeaturesParametersLevelLJD mean LJD std LJD max # Cluster with LJD(C) = 0 DBSCAN structuralε = 0.6, min_samples = 10140.9030.0520.9630 structural + content ε = 0.9, min_samples = 280.1580.2540.979133 OPTICS structuralxi = 0.1, min_samples = 2110.5920.3681.09387 structural + content xi = 0.3, min_samples = 280.2420.3051.088170 AHC structuralt = 75.0140.9010.0470.9590 structural + contentt = 5.0150.3510.3351.03655 TABLE IV: Best configuration for each algorithm using structural and content-based information, and the corresponding results obtained during quantitative validation. In bold the best values in each case. information acts as noisy information during the clustering process, increasing uncertainty in terms of clustering metrics. VI. CLUSTER VALIDATION A. Quantitative Validation Table IV reports the level-wise Jaccard Distance Score computed for the best configuration of each algorithm, as introduced in Section I-D. The table shows that all three algorithms produce the lowest LJD mean values when con- tent features are used, with DBSCAN achieving the overall lowest value of 0.158. These lower values indicate that, on average, the ratio between cluster compactness and disper- sion decreases when this additional information is incorpo- rated. Thus, this suggests improved cluster separation among samples. However, considering LJD std , high variability is generally observed across all algorithms, except for DBSCAN and AHC using only structural features. In fact, in both cases, LJD mean is similar to LJD max . Looking at these latter values (LJD max ), the algorithms remain consistent, showing that in the worst case at least one cluster exhibits a ratio close to 1, meaning that samples within the cluster are approximately as distant from each other as they are from samples in different clusters (or even more so). Finally, the last column of Table IV reports the number of clusters for which LJD(C) = 0, i.e., fully compact clusters where LJD intra = 0, meaning that all samples within the cluster are structurally identical. Surprisingly, even when only structural features are considered during clustering, OPTICS is already able to identify 87 fully compact clusters. This suggests that structural information alone can be sufficient to group together subsets of webpages with identical level-wise DOM-tag dis- tributions. When content-based features are incorporated, the number of fully compact clusters further increases, reaching 133 clusters for DBSCAN, 170 for OPTICS, and 55 for AHC. This result indicates that adding tag-level information strengthens the formation of highly homogeneous groups, although it also contributes to a more fragmented clustering structure. B. Qualitative Validation Figures 6 and 7 report the tree structures belonging to the three most compact clusters, i.e., the clusters with the lowest LJD(C) values, when considering structural features and structural-content features, respectively. To avoid presenting trivial cases composed of identical samples and to provide a more informative visual comparison, clusters withLJD(C) = 0 were excluded from the selection. Figure 6 shows the medoids and samples of the clusters obtained using only structural features, labeled as S1, S2, and S3. By inspecting the medoids, it can be observed that they share a similar structure in their <head> branch. Specifically, S2 and S3 exhibit the same tag structure. Moreover, S2 and S3 also share a similar structure within the <body> branch. However, they differ significantly in their last two levels, where S3 contains more nodes than S2. Yet, looking at the samples extracted from each cluster, it possible to see that samples from S1 have the same structure of the medoid, due to the very low LJD (0.0022). On the other hand, for higher values, such as 0.0102 in S3, the samples show small difference with the medoids. Figure 7 reports the qualitative results obtained when content-based features are also included, labeled as SC1, SC2, and SC3. In this case, considering only the medoids, their structures differ substantially from one another, with SC2 exhibiting a particularly complex configuration. Nevertheless, in SC1, the medoid and the two selected samples are visually almost identical, differing only by a single change in the <head> branch. In contrast, SC2 is characterized by much larger and deeper trees. Despite their size, the medoid and the selected samples share a highly similar overall structure, mainly consisting of an extended horizontal organization with several repeated small branches. Finally, the samples belong- ing to SC3 differ in the number of nodes present in their deepest levels, as shown in Figure 7. Finally, to provide a more comprehensive view of the gen- erated clusters, a qualitative analysis of the medoids extracted from the most dispersed clusters was conducted and is reported in Appendix B. C. Discussion The results presented in this work show that DOM-tree representations provide a useful basis for identifying structural similarities among phishing webpages. Across the evaluated clustering algorithms, the grid-search analysis indicates that meaningful groupings can be obtained from the extracted tree features, although each algorithm reacts differently to the type of information used. When only structural properties are considered, the best configurations tend to appear at deeper DOM levels, suggesting that global tree complexity and nested organization provide relevant information for distinguishing phishing templates. In contrast, when content-based features S1 (LJ D(C) = 0.0022) Medoid Samples S2 (LJ D(C) = 0.0081) Medoid Samples S3 (LJ D(C) = 0.0102) Medoid Samples Fig. 6: Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural based features. Changes are marked with a black circle. are incorporated, the best configurations for density-based methods are generally obtained at shallower levels. This indi- cates that tag-level information introduces a more specific but also more variable description of the webpages, making deeper levels more sensitive to local implementation differences. The comparison between structural-only and structural- content representations highlights a central trade-off. Struc- tural features provide a general characterization of the DOM, capturing aspects such as size, connectivity, and global topol- ogy. As a result, they are useful for detecting broad structural SC1 (LJ D(C) = 0.0003) Medoid Sample 1Sample 2 SC2 (LJ D(C) = 0.0053) Medoid Samples SC3 (LJ D(C) = 0.0058) Medoid Samples Fig. 7: Qualitative analysis: medoids of N compacted clusters and two random samples from each cluster, using structural and content-based features. Changes are marked with a black circle. reuse patterns, but they may group together webpages that share a similar shape while differing in the specific HTML elements used. Conversely, adding content-based features sub- stantially reduces LJD mean for all algorithms, indicating more compact clusters according to the level-wise distribution of HTML tags. This suggests that content information refines the notion of similarity and helps identify more specific template variants. However, this refinement also increases fragmentation: density-based methods produce a higher pro- portion of noisy samples, while AHC generates many singleton clusters. Therefore, content-based features improve specificity but reduce coverage, whereas structural-only features provide broader but less fine-grained groupings. The qualitative validation further supports this interpreta- tion. The selected compact clusters correspond to visually coherent groups of DOM trees, which is consistent with the idea that phishing kits, reusable templates, and shared web components can generate multiple webpages with highly similar internal structures. In these cases, even if pages differ in domains, visual details, or deployment context, their un- derlying DOM organization may preserve evidence of tem- plate reuse or common construction logic. Conversely, the dispersed clusters contain heterogeneous structures, including simplified or almost flattened DOMs. These cases suggest that not all phishing webpages expose the same level of structural regularity: some may rely on minimal HTML, redirection mechanisms, dynamically generated content, or incomplete/obfuscated structures, making them more difficult to compare through tree-based representations. D. Limitation & Future Work Despite the promising results achieved by the proposed approach, several (potential) issues need to be highlighted. First, although the use of content-based features yielded the best overall performance according to the introduced metric, clustering algorithms based on these features were character- ized by a high number of unclustered elements (DBSCAN, OPTICS) and singleton groups (AHC). In this regard, strate- gies for incorporating these instances into the analysis, such as nearest-cluster assignment or two-stage clustering, should be further investigated; otherwise, a significant portion of the dataset remains unanalyzed. Furthermore, although the proposed metric proved useful for assessing cluster quality, it is important to note that it relies exclusively on tag-based and level information. As these same features are also employed during clustering, the evaluation may be partially biased to- ward clustering solutions generated from similar information. Consequently, approaches based on content features may nat- urally yield more compact clusters according to this metric. To mitigate this potential bias, alternative and more feature- agnostic distance measures, such as graph edit distance, should be explored. E. Ethics Concerns From an ethical research perspective, three key considera- tions must be considered. Firstly, although the dataset primar- ily consists of publicly accessible phishing webpages collected for security research purposes, it may still contain sensitive information, including personally identifiable information (PII) such as email addresses, names, telephone numbers, and other identifiers inadvertently exposed within page content. Secondly, the proposed methodology raises dual-use con- cerns. While the approach is intended to support cybersecu- rity objectives by characterising phishing infrastructure and improving detection and defensive mechanisms, the inferred structural and behavioural insights could potentially be ex- ploited by malicious actors to adapt their tactics, techniques, and procedures (TTPs), thereby increasing the sophistication and evasiveness of phishing campaigns. Thirdly, although clustering and structural similarity anal- ysis may suggest commonalities between phishing webpages, such inferences should not be interpreted as definitive evidence of shared authorship or attacker identity. Any attribution- related conclusions must be treated as probabilistic and used exclusively for defensive and threat intelligence purposes. VII. CONCLUSION This work investigated whether the HTML structure of phishing webpages can be used as a reliable fingerprint for identifying structural similarities and potential template reuse. By representing webpages as DOM trees and clustering them using structural and content-based features, the results show that recurrent patterns can be detected without relying on prior labels. Structural features provide a broader view of common DOM organization, while the inclusion of tag-level content information enables a more fine-grained identification of highly homogeneous template variants. The proposedLJD metric and the qualitative validation further confirm that com- pact clusters correspond to visually coherent tree structures. Overall, the findings support the use of DOM-based clustering as a promising approach for phishing template analysis, while also highlighting the need to better handle noisy, flattened, or highly fragmented samples in future work. ACKNOWLEDGMENTS This work has been partially supported by the European Union through the Horizon Europe Programme under the projects SAFEHORIZON (Grant Agreement No. 101168562), ENSEMBLE (Grant Agreement No. 101168360), and by Vicomtech under the project ATHENA-CV (Grant Number E22503/2024). The content of this article does not reflect the official opinion of the European Union. Responsibility for the information and views expressed therein lies entirely with the authors. REFERENCES [1] Anti-Phishing Working Group (APWG), “Phishing activity trends report, 1st quarter 2025,” APWG, Tech. Rep., July 2025, published July 2, 2025. [Online]. Available: https://w.apwg.org [2] Europol, “Internet organised crime threat assessment - iocta 2026,” accessed on 08/06/2026. [Online]. Available: https://w.europol. europa.eu/cms/sites/default/files/documents/IOCTA-2026.pdf [3] W. Li, S. U. A. Laghari, S. Manickam, Y.-W. Chong, and B. Li, “Machine learning-enabled attacks on anti-phishing blacklists,” IEEE Access, vol. 12, p. 191 586–191 602, 2024. [4] S. Asiri, Y. Xiao, and T. Li, “Phishtransformer: A novel approach to detect phishing attacks using url collection and transformer,” Journal Name (Reemplazar por el nombre de la revista si lo tienes), 2024, published online Dec 2023. [5] H. Jiang, Y. Chen, Y. Zhu, X. Xu, Y. Song, and Q. Chen, “D-phishnet: A dual-branch network for url and html feature fusion in phishing webpage detection,” Nombre de la Revista (ej. Future Generation Computer Systems o similar), 2025. [6] T. Song, P. Casas, and M. Meo, “Phishing the phishers with specular- net: Hierarchical graph autoencoding for reference-free web phishing detection,” arXiv preprint arXiv:2603.01874, 2026. [7] F. Casta ̃ no, E. F. Ferna ̃ ndez, R. Alaiz-Rodr ́ ıguez, and E. Alegre, “Phikita: Phishing kit attacks dataset for phishing websites identification,” IEEE Access, vol. 11, p. 40 779–40 789, 2023. [8] H. Bijmans, T. Booij, A. Schwedersky, A. Nedgabat, and R. van Wegberg, “Catching phishers by their bait: Investigating the dutch phishing landscape through phishing kit detection,” in 30th USENIX security symposium (USENIX security 21), 2021, p. 3757–3774. [9] A. K. Jain and B. B. Gupta, “Phishing detection: analysis of visual similarity based approaches,” Security and Communication Networks, vol. 2017, no. 1, p. 5421046, 2017. [10] A. Oest, Y. Safei, A. Doup ́ e, G.-J. Ahn, B. Wardman, and G. Warner, “Inside a phisher’s mind: Understanding the anti-phishing ecosystem through phishing kit analysis,” in 2018 APWG Symposium on Electronic Crime Research (eCrime). IEEE, 2018, p. 1–12. [11] E. Merlo, M. Margier, G.-V. Jourdan, and I.-V. Onut, “Phishing kits source code similarity distribution: A case study,” in 2022 IEEE Inter- national Conference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 2022, p. 983–994. [12] M. Ester, H.-P. Kriegel, J. Sander, X. Xu et al., “A density-based algorithm for discovering clusters in large spatial databases with noise,” in kdd, vol. 96, no. 34, 1996, p. 226–231. [13] M. Ankerst, M. M. Breunig, H.-P. Kriegel, and J. Sander, “Optics: Ordering points to identify the clustering structure,” ACM Sigmod record, vol. 28, no. 2, p. 49–60, 1999. [14] D. M ̈ ullner, “Modern hierarchical, agglomerative clustering algorithms,” arXiv preprint arXiv:1109.2378, 2011. [15] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning based phishing detection from urls,” Expert Systems with Applications, vol. 117, p. 345–357, 2019. [16] D. O. Otieno, F. Abri, A. S. Namin, and K. S. Jones, “Detecting phishing urls using the bert transformer model,” in 2023 IEEE International Conference on Big Data (BigData). IEEE, 2023, p. 2483–2492. [17] K. S. Mandapati, S. Meesala, D. Maddela, K. Ponnada, H. Neyyala, and E. A. Shaik, “A hybrid transformer ensemble approach for phishing website detection,” in 2023 International Conference on Self Sustainable Artificial Intelligence Systems (ICSSAS). IEEE, 2023, p. 1–8. [18] K. V. Ajay Kumar, P. S. Balasubramaniyamoorthy, R. Deepalakshmi, and K. R. SenthilMurugan, “A proactive method using machine learning models to detect phishing attacks in thread sharing network,” Nombre de la Revista o Conferencia, 2024. [19] L. D. Nguyen, D.-N. Le, and L. T. Vinh, “Detecting phishing web pages based on dom-tree structure and graph matching algorithm.”Associ- ation for Computing Machinery, 2014, pioneering structural analysis using Genetic Algorithms. [20] K. Althobaiti, M. K. Wolters, N. Alsufyani, and K. Vaniea, “Using clustering algorithms to automatically identify phishing campaigns,” Nombre de la Revista o Conferencia (ej. ACM Digital Library), 2023. [21] A. Aljofey, S. A. Bello, J. Lu, and C. Xu, “Comprehensive phishing detection: A multi-channel approach with variants tcn fusion leveraging url and html features,” Journal of Network and Computer Applications, vol. 238, p. 104170, 2025. [22] D. R. White and S. P. Borgatti, “Betweenness centrality measures for directed graphs,” Social networks, vol. 16, no. 4, p. 335–346, 1994. [23] L. C. Freeman, “Centrality in social networks conceptual clarification,” Social Networks, vol. 1, p. 215–236, 1978. [24] M. Bastian, S. Heymann, and M. Jacomy, “Gephi: an open source software for exploring and manipulating networks,” in Proceedings of the international AAAI conference on web and social media, vol. 3, 2009, p. 361–362. [25] I. F. Ashari, E. D. Nugroho, R. Baraku, I. N. Yanda, and R. Liwar- dana, “Analysis of elbow, silhouette, davies-bouldin, calinski-harabasz, and rand-index evaluation on k-means algorithm for classifying flood- affected areas in jakarta,” Journal of Applied Informatics and Comput- ing, vol. 7, no. 1, p. 95–103, 2023. APPENDIX A GRID-SEARCH RESULTS (PART I) As mentioned, while Section V-A reports grid-search results obtained using clustering algorithms based solely on structural information, this section presents the results when structural information is combined with content-based features. In these figures (9,10,8), the best-performing configurations are high- lighted with a red box. These configurations are then used in Section V-B. APPENDIX B QUALITATIVE VALIDATION - PART I In terms of dispersed clusters, Figure 11 reports the medoids of the clusters with the highest LJD(C) values. Specifically, Figure 11a shows the three selected clusters obtained using only structural features, while Figure 11b shows the three selected clusters obtained when structural and content-based features are combined. Compared with the compact clusters reported in Figures 6 and 7, these medoids exhibit more heterogeneous configurations, including trees with reduced depth, simplified structures, or clearly different branching organizations. In some cases, the medoids consist of only three 5.025.050.075.0100.0 threshold 8 9 10 11 12 13 14 15 level .715.554.362.218.096 .711.558.402.196.121 .707.570.379.218.161 .707.572.398.211.139 .703.569.410.219.175 .707.566.419.192.149 .707.560.399.216.176 .706.557.413.189.135 0.0 0.2 0.4 0.6 0.8 1.0 Fig. 8: AHCS score during the grid-search using structural and content-based features. levels; that is, after removing the first two levels, correspond- ing to <html> and <head>/<body>, the remaining DOM structure is almost completely flattened. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .552.569.576.583.577.582.579.588.591.536 .436.457.470.479.480.491.496.501.501.448 .353.385.400.412.421.426.433.439.449.406 .311.335.361.374.382.392.409.416.421.378 .288.305.318.339.353.368.377.387.394.368 0.0 0.2 0.4 0.6 0.8 1.0 (a) Level 8. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .546.567.569.581.573.574.577.583.575.520 .428.452.461.474.470.475.483.487.482.433 .346.380.399.411.411.412.427.430.432.396 .301.324.350.368.371.377.397.405.404.368 .282.292.308.326.335.348.369.371.377.358 0.0 0.2 0.4 0.6 0.8 1.0 (b) Level 9. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .541.560.564.572.562.567.571.581.572.516 .422.443.452.468.460.468.479.482.476.428 .341.368.384.405.405.410.420.426.429.393 .289.315.336.355.362.367.389.394.396.365 .266.287.297.318.329.341.360.369.368.354 0.0 0.2 0.4 0.6 0.8 1.0 (c) Level 10. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .535.558.562.568.559.560.569.581.570.515 .411.441.448.460.455.460.475.480.471.423 .331.363.374.394.394.403.414.422.424.387 .279.306.327.341.355.363.383.393.393.357 .259.278.290.309.320.337.355.362.363.346 0.0 0.2 0.4 0.6 0.8 1.0 (d) Level 11. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .524.549.553.555.552.557.561.572.563.507 .394.423.435.452.447.456.466.470.463.413 .325.354.363.385.387.395.404.412.419.380 .276.296.312.327.338.348.367.385.385.350 .256.265.271.294.306.322.342.355.356.340 0.0 0.2 0.4 0.6 0.8 1.0 (e) Level 12. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .523.546.553.557.546.550.553.568.557.501 .394.420.432.446.440.448.457.465.459.407 .327.351.361.377.380.387.396.406.412.373 .276.298.312.323.332.340.359.374.374.343 .256.265.271.284.300.317.334.347.347.331 0.0 0.2 0.4 0.6 0.8 1.0 (f) Level 13. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .521.543.550.555.542.547.550.561.554.500 .394.416.428.439.434.440.451.454.452.403 .325.351.359.367.370.377.388.395.401.362 .273.295.310.320.323.334.353.365.365.330 .253.262.270.283.294.311.326.335.337.318 0.0 0.2 0.4 0.6 0.8 1.0 (g) Level 14. 0.10.20.30.40.50.60.70.80.91.0 eps 2 3 5 8 10 min_samples .521.540.549.552.539.544.548.559.551.497 .392.414.428.438.432.438.448.450.448.399 .324.350.358.366.367.376.387.394.400.360 .273.295.309.320.322.332.350.364.364.329 .252.261.269.282.292.309.324.334.336.316 0.0 0.2 0.4 0.6 0.8 1.0 (h) Level 15. Fig. 9: DBSCAN S score during the grid-search using structural and content-based features. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .522.503.639.627.611.599.591.581.569 .405.387.510.498.482.478.469.453.437 .323.308.442.412.400.384.377.361.349 .281.259.386.386.367.347.343.319.307 .244.205.362.346.334.320.317.301.280 0.0 0.2 0.4 0.6 0.8 1.0 (a) Level 8. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .518.557.545.533.515.503.492.482.469 .399.436.411.398.384.380.368.355.339 .329.365.348.322.312.291.284.267.253 .267.263.262.249.273.258.253.223.209 .229.236.229.216.243.227.219.196.189 0.0 0.2 0.4 0.6 0.8 1.0 (b) Level 9. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .543.550.536.528.510.493.484.470.459 .430.431.407.398.386.373.360.344.330 .349.350.335.316.298.282.269.257.241 .289.301.288.273.263.242.231.207.196 .262.266.259.246.232.219.204.183.176 0.0 0.2 0.4 0.6 0.8 1.0 (c) Level 10. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .544.532.520.532.516.498.487.473.461 .427.407.387.394.384.369.356.341.326 .340.320.316.312.300.275.265.249.236 .289.261.266.274.258.245.240.202.190 .256.225.235.234.234.220.212.173.168 0.0 0.2 0.4 0.6 0.8 1.0 (d) Level 11. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .392.378.370.361.488.469.458.442.429 .273.252.236.221.350.337.326.307.289 .193.176.171.146.273.254.240.229.212 .145.119.123.104.234.216.210.183.167 .110.081.081.064.192.191.182.153.146 0.0 0.2 0.4 0.6 0.8 1.0 (e) Level 12. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .475.462.450.439.460.441.571.555.544 .351.332.304.296.319.305.434.418.403 .276.262.250.224.239.220.360.337.322 .221.191.173.171.198.188.313.291.281 .191.157.145.141.156.157.281.263.258 0.0 0.2 0.4 0.6 0.8 1.0 (f) Level 13. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .322.457.448.470.598.583.572.555.545 .195.328.312.334.466.450.439.418.405 .125.259.255.258.370.368.362.338.323 .075.190.175.195.338.336.327.293.277 .041.151.151.168.311.301.295.264.254 0.0 0.2 0.4 0.6 0.8 1.0 (g) Level 14. 0.10.20.30.40.50.60.70.80.9 xi 2 3 5 8 10 min_samples .467.488.478.464.450.437.426.409.400 .347.364.345.337.327.310.294.275.261 .280.299.291.261.237.230.222.201.184 .225.221.205.193.196.191.173.149.137 .189.187.174.168.165.159.141.119.113 0.0 0.2 0.4 0.6 0.8 1.0 (h) Level 15. Fig. 10: OPTICS S score during the grid-search using structural and content-based features. S4 (LJD(C) = 0.9916)S5 (LJD(C) = 0.9607)S6 (LJD(C) = 0.9701) (a) Structural features SC4 (LJD(C) = 0.9724)SC5 (LJD(C) = 0.8626) SC6 (LJD(C) = 0.8716) (b) Structural and content-based features Fig. 11: Qualitative analysis: - medoids of N dispersed clusters.

Instant research discovery