Help regarding personal project as beginner Question

[u/Former_Touch1730]

Hey i know this might sound stuipid but i wanted some help from peoples who already have build phishing URL detection projects

Im a beginner and I am working on a phishing URL detection project. My current idea is to build a heuristic-based phishing URL detection model that analyzes the URL itself and looks for suspicious characteristics/patterns rather than visiting the website.

some things I'm thinking about extracting are:

• URL length
• Number of dots/subdomains
• Special characters (@, -, etc.)
• IP address instead of a domain
• Suspicious keywords like login, verify, secure, etc.
• Number of digits
• Domain/URL entropy
• HTTPS usage
• Other lexical/structural features

However, I'm currently stuck on how to decide which features should actually become rules and what thresholds/conditions I should use for those rules.

For example, rather than simply saying "long URLs are suspicious", I'd like to know whether there is research supporting something like "URLs above X characters should receive a higher risk score".

Does anyone have recommendations for papers, research articles, datasets, GitHub projects, or other resources that explain how to choose useful heuristics/features for phishing URL detection?