Recently, the development and implementation of phishing attacks require
little technical skills and costs. This uprising has led to an ever-growing
number of phishing attacks on the World Wide Web. Consequently, proactive
techniques to fight phishing attacks have become extremely necessary. In this
paper, we propose HTMLPhish, a deep learning based data-driven end-to-end
automatic phishing web page classification approach. Specifically, HTMLPhish
receives the content of the HTML document of a web page and employs
Convolutional Neural Networks (CNNs) to learn the semantic dependencies in the
textual contents of the HTML. The CNNs learn appropriate feature
representations from the HTML document embeddings without extensive manual
feature engineering. Furthermore, our proposed approach of the concatenation of
the word and character embeddings allows our model to manage new features and
ensure easy extrapolation to test data. We conduct comprehensive experiments on
a dataset of more than 50,000 HTML documents that provides a distribution of
phishing to benign web pages obtainable in the real-world that yields over 93
percent Accuracy and True Positive Rate. Also, HTMLPhish is a completely
language-independent and client-side strategy which can, therefore, conduct web
page phishing detection regardless of the textual language.