The shift of services to cyberspace has created new opportunities for attackers who generate malicious domains that mimic popular websites in order to deceive users and obtain their sensitive information, such as login credentials, personal data, or payment information. Such domains pose a significant risk to cybersecurity and user privacy. This paper aims to design and implement a tool for the fast and eficient identification of new Slovak domains that may represent security threats. For this purpose, we created a custom dataset comprising approximately 900 benign and 900 malicious domains. The benign domains were selected manually based on their established reputation, while the malicious domains were collected from publicly available lists. After extracting 29 relevant domain attributes, we applied three machine learning models: logistic regression, Random Forest, and XGBoost. The highest detection accuracy was achieved by Random Forest (97.5%) and XGBoost (97.4%), confirming the efectiveness of the proposed approach.
Nowadays, there are a large number of suspicious websites on the Internet, which are perceived as harmless at first glance by the average user. They look like harmless existing sites, imitating them in name but also in appearance. Often the aim of these sites is to deceive the user, to infect him, or to obtain personal data.
There are now various domain verification tools and approaches that use a combination of blacklists and services to see if a domain is suspicious. However, there is a problem here if the domain is new and these services and blacklists have not yet picked up information about it. In that case, it would be advisable to use a tool that would act proactively and try to analyze the characteristics of the site and classify it as benign or malignant accordingly.
To summarize the problems outlined above, we emphasize the following questions that we aim to answer: • Which methods are shown to be suitable for identifying malicious domains? • Which attributes influence the identification of malicious domains?
To answer these questions, we have focused on the analysis of ‘.sk’ top-level domains that uses machine learning models trained on our own dataset, which consists only of Slovak domains.
The aim of the article is to create a dataset with Slovak domains and use existing machine learning methods. We focus on all domains with the aim that if a new domain is added, our model will be able to immediately classify it as malignant or benign.
In section 2, we explored existing approaches to proactive analysis and classification of domains, focusing on machine learning models and their efectiveness. In section 3, we described methods for
CEUR Workshop
ISSN1613-0073 collecting domain data from open sources, which we utilized in our tool and we detailed the practical part, including attribute selection, data preparation for model training, data cleaning and preprocessing, and the training of machine learning models. In the final, section 4, we presented our solution for automating the analysis of network entities using machine learning and explained the operational principles of our tool. Additionally, we evaluated the efectiveness of the applied machine learning models and discussed their performance.
In the field of classifying domains as malicious or benign, various methods have been developed to tackle this issue. Malicious domains may include those hosting phishing sites, fraudulent shops, or other platforms used for harmful activities. Most research in this area follows a similar approach, primarily focusing on expanding the range of features monitored to identify a domain’s maliciousness. The key distinction between these methods typically lies in the choice of machine learning techniques, which are selected based on the specific requirements of each study.
Domain blacklists were among the earliest methods to counter malicious domains, particularly phishing
ones, by warning users against visiting dangerous sites. These lists store known malicious domains
to inform users to avoid them [
Fukushima et al. [
Machine learning, a subset of artificial intelligence, involves algorithms that enable computers to
predict outcomes by identifying patterns in input data [
Machine learning is divided into supervised and unsupervised learning. Supervised learning, similar
to learning with a teacher, uses labeled training data, assigning each example to a class in classification or
an output value in regression. Unsupervised learning, or learning without a teacher, relies on unlabeled
data, requiring the model to independently identify similarities among examples [
Logistic regression, a generalized linear model derived from linear regression, is designed to predict
categorical data, particularly binary outcomes, rather than continuous values [
Decision tree, a type of supervised learning algorithm, operates using decision nodes that evaluate
specific data attributes. Based on these evaluations, the algorithm navigates through subsequent nodes
until reaching leaf nodes, which represent the predicted value or class for the input data [
Bilge et al. [
Messabi et al. [
Horak [
Ma et al. [
In addition to exploring existing approaches, our research includes designing our own tool for classifying malicious or suspicious domains and evaluating it. In our approach, we have used machine learning because it seems to be a suitable, powerful and eficient approach to solve the problem of this paper. In the following subsections, we discuss the process of attribute selection, data collection, processing and editing, and describe the selected machine learning models, their hyperparameter settings and training.
For the selection of attributes, we were inspired by existing approaches, which we described in Chapter
2. We mainly used existing attributes collected by Marques et al [
The retained WHOIS data attributes were Registrar, CreationDate, and LastUpdate, with Registrar indicating the domain lessor. For benign domains, common lessors included Websupport s.r.o., Webglobe, a.s., WebHouse, s.r.o., WEBY GROUP, s.r.o., and INTERNET CZ, a.s. Notably, WebHouse, s.r.o. and Webglobe, a.s. are accredited registrars under SK-NIC, a.s., the registry administrator for the ‘.sk’ top-level domain and ‘org.sk’ second-level domain, with accreditation ensuring service quality verification [ 22]. Among malicious domains, Gransy s.r.o. was the most prevalent registrar, favored by attackers for its low-cost hosting for certain TLDs and WHOIS data obfuscation, which complies with GDPR but is often indicative of malicious domains. Using ViewDNS.info’s Reverse IP Lookup tool [70], we determined that IP addresses linked to Gransy Ltd. were almost always associated with phishing or other malicious sites.
For the CreationDate and LastUpdate attributes, we focused on the domain’s age and its most recent update. We modified these attributes based on the original dataset as follows: domains younger than one month or last updated less than one month ago were assigned a value of 1; those less than six months old or updated less than six months ago were given a value of 2; those less than one year old or updated less than one year ago were tagged with a value of 3; and those older than one year or updated more than one year ago were assigned a value of 4. If no data was available for either attribute, we assigned a value of 0.
In Figure 1 we see the 5 most used registrars associated with benign domains. As we mentioned earlier, the most used among them is Websupport s.r.o. In Figure 2, on the other hand, the 5 most used registrars associated with malicious domains are shown. Gransy s.r.o. used more than 400 malicious domains contained in our dataset.
Domain Name System (DNS) and its records provide insight into domain classification. We retained attributes related to MX, SPF, DKIM, and DMARC records from the dataset, tracking their presence as binary attributes. A domain with an MX record was assigned a value of 1, while those without received a 0. Similarly, we tracked SPF, DKIM, and DMARC records, which indicate domain legitimacy and security. Although these records are often automatically added by service providers, most malicious domains in our dataset lacked them.
From query headers for a given domain, we can extract details such as the server type processing the request and generating the response, the page’s Content Type, and the charset (character set) used. Additionally, the query response code—such as 200 OK or codes starting with 3 (redirects), 4, or 5 (errors)—provides further insight. Our analysis focused primarily on the page response to identify redirects, which could suggest fraudulent activity, and the server type, as outdated servers may indicate vulnerabilities. Initially, we examined Content-Type and charset, but these were consistent across domains and thus deemed negligible.
We aimed to detect malicious domains via 3xx redirect responses, but our current dataset lacks such cases. However, we note that the 4xx and 5xx response codes, often associated with malicious domains, indicate server issues, either temporary or permanent, suggesting poor server configuration [ 23] or a domain that no longer exists.
NETIM
WebHouse, s.r.o. Key-Systems GmbH
ACTIVE 24, s.r.o. Numerous studies have tracked attributes like domain length and specific keywords to assess domain maliciousness. We observed that malicious domains typically have longer names. Furthermore, certain words such as ’obchod’, ’vypredaj’, ’slovakia’, ’slovensko’, ’topanky’ and similar terms were prevalent in malicious domains. These were often used to mimic the Slovak versions of popular fashion brand websites or to entice users with discounted merchandise ofers.
We analyzed the ratios of vowels, consonants, digits, and hyphens to the total number of characters in domain names. In our dataset, domains with a high number of digits were predominantly malicious, with the exception of the benign domain ‘101drogeria.sk’. Hyphens were also more common in malicious domains, particularly those that mimicked well-known brands, such as ‘slovak-converse.sk’. Although hyphens alone are not a definitive indicator of maliciousness, their presence, combined with the length of the above average domain name, often suggests a malicious domain. Furthermore, we observed the’sk’ substring at the end of domain names as a notable attribute in fraudulent domains. For example, the malicious domain ’intimissimislovensko-sk.sk’ leveraged these characteristics: long length, hyphens and specific substrings to masquerade as the benign domain ‘intimissimi.com’.
We also examined lexical features such as the longest sequences of vowels, consonants, numerals, and hyphens in domain names. In Slovak domains, long sequences are uncommon, as consonants typically alternate with vowels. However, fraudulent domains aiming to appear as foreign websites often exhibited longer consonant sequences.
Additionally, we considered Levenshtein distance, which measures the similarity between two strings by calculating the minimum number of character additions, deletions, or substitutions needed to transform one into the other [24]. This metric is particularly useful for detecting typosquatting, as discussed in Section 2.2. A smaller Levenshtein distance indicates greater similarity to a legitimate domain. For example, the malicious domain ‘decathlo.sk’ has a Levenshtein distance of 1 from the benign domain ‘decathlon.sk’, as only one character addition is needed to convert the malicious domain into the benign one.
Levenshtein distance between two strings and of lengths and is defined as the minimum number of operations (insertion, deletion, or substitution of a character) required to transform string into string . The algorithm uses dynamic programming and constructs a matrix of dimensions ( + 1) × ( + 1) .
1. Initialization: Create a matrix with dimensions ( + 1) × ( + 1) . Initialize the first row and column: (, 0) = for = 0, … , , (0, ) = for = 0, … , . (, ) =
⎧( − 1, ) + 1 min (, − 1) + 1 ⎨ ⎩( − 1, − 1) + ( (deletion), (insertion), −1 , −1 ) (substitution), where ( −1 , −1 ) = 0 if −1 = −1 , otherwise ( −1 , −1 ) = 1.
3. Result: The Levenshtein distance is the value (, ) .
We used this metric and inserted it into the dataset as a lexical attribute, observing whether it had an impact on the results of the methods used.
Detecting Unicode characters in domain names appeared promising for identifying malicious domains, particularly for typosquatting detection, but our current dataset lacks domains with Unicode characters among the malicious ones identified. Despite this, we consider Unicode detection important, as it can reveal attempts to create visually similar domain names, akin to typosquatting. For instance, attackers may use Cyrillic characters that resemble Latin ones—e.g., the Latin ’O’ (U+004F) versus the Cyrillic ’О’ (U+043E)—to craft deceptive domains [ 25].
Additionally, we examined Shannon entropy as a lexical attribute to measure the randomness of characters in a domain name [26]. This metric is particularly useful for detecting domains generated by Domain Generation Algorithms (DGAs) which often produce highly random strings indicative of malicious activity.
We tracked the provider or Certificate Authority (CA) issuing SSL certificates for domains, along with the Time To Live (TTL) of these certificates, indicating their remaining validity period. This is particularly relevant for newly created domains, as malicious ones often have short TTLs.
The most prevalent CA was Let’s Encrypt [27], ofering free TLS/SSL certificates. While HTTPS encryption secures data transmission, it can create a false sense of trust for users, as malicious domains exploit the browser’s lock symbol, which does not guarantee a site’s trustworthiness. Another notable provider was Google Trust Services [28], also issuing free certificates.
The attribute concerning the server location, specifically the country hosting the domain, revealed distinct patterns in our dataset. Benign domains were frequently hosted in Slovakia or the Czech Republic, though some, like ‘kaufland.sk’, associated with foreign trade, originated elsewhere. In contrast, malicious domains were commonly hosted in Canada or other locations, such as the USA.
We selected 29 relevant attributes, description in table 5 (appendix A).
To create the dataset, we first needed to collect samples to extract attributes for populating it. SKNIC, a.s. [22], the administrator of Slovak domains, provides a comprehensive list of all ‘.sk’ top-level domains, giving us access to all Slovak domains for inclusion. The challenge was distinguishing between malicious and benign domains.
We began by compiling a list of benign domains, manually selecting those we confirmed were nonmalicious. These included domains associated with reputable brands, ofices, stores, driving schools, hotels, and similar entities.
To identify malicious domains, we initially compiled a list using domains published by the Slovak Trade Inspection on its website [29]. Additionally, we sourced approximately 1,200 malicious domains identified by characteristics such as terms in their names, including ‘slovakia’, ‘slovensko’, ‘bratislava’, ‘outlet’, ‘bunda’, ‘obuv’, ‘topánky’, ‘kabelka’, ‘tenisky’, ‘akcia’, ‘eshop’, ‘ruksak’, or ‘výpredaj’. Other observed attributes included grammatical errors and typosquatting [30].
Beyond categorizing domains as legitimate or malicious, we created a separate list for the Levenshtein distance attribute, incorporating global domains like ‘paypal.com’. This list helps detect typosquatting attempts where attackers create illegitimate Slovak domains with names mimicking legitimate ones.
To develop the tool, we created data collection scripts to gather attributes for training machine learning models. These scripts were implemented in Python, with separate scripts for each attribute category: WHOIS, DNS, lexical properties, headers, and location. For example, we utilized the ‘requests‘ library [31] to send HTTP/1.1 requests and combined it with the IP-API service to retrieve the server location hosting the domain.
We consolidated the individual scripts into a single master script that sequentially executed each attribute collection function on the domain list we compiled. By importing these functions into the master script and processing the list, we used the ‘pandas‘ library [32] to generate a CSV file containing the collected data.
The dataset contains 1799 rows and 30 attributes described in Table 5. In our dataset, each entry represents a domain. Each of them is also assigned a class, the attribute Class, which characterizes the domain as either benign (0) or malignant (1). There are 1156 benign domains and 643 malignant ones.
Building on prior work, we selected three machine learning models known for high success in domain classification: Logistic Regression, Random Forest, and XGBoost, as detailed in 2.2. We chose multiple algorithms to evaluate their performance on our dataset and to address the limitations of our smaller dataset, which could afect a single model’s ability to accurately classify domains. Our approach involved training each model on the training set and testing it on the test set. For new input domains, each model provides a classification, and the final label is determined by majority voting—e.g., if two of the three models classify a domain as malicious, it is labeled as such. This ensemble method enhances confidence in the classification compared to relying on a single model.
The preprocessing phase was crucial for preparing the data for machine learning models. We cleaned the data by removing or handling empty values, transformed categorical attributes using appropriate encoding, and scaled the data for the Logistic Regression model. Specifically, we removed rows with empty values, as Logistic Regression and Random Forest models cannot process them. where: where: data. where:
Encoding transforms categorical attributes into numerical ones, as most machine learning models perform better with numerical data or cannot process categorical attributes at all. Given the high cardinality of our categorical attributes (many unique values), we applied Target Encoding. This method replaces each category with the average of the target variable—Class in our case—across all samples in that category [33].
The formula for Target Encoding can be expressed as:
TE() = ∑= 1
• TE() represents the Target Encoding for category , • is the value of the target class for the -th sample in category , • is the total number of samples in category .
During Target Encoding, we encountered an issue due to our small dataset, where certain categories had limited samples, making their relationship with the target class less reliable. This could lead the model to incorrectly assume that all domains associated with a specific category, such as location, are malicious, introducing bias. To address this, we applied a smoothing parameter, ‘smooth’, which adjusts the Target Encoding values by incorporating the global target average.
The formula for smoothed Target Encoding is:
TEsmoothed() = ⋅ TE() + ⋅ ̄ global + • TEsmoothed() is the smoothed Target Encoding for category , • is the number of samples in category , • TE() is the unsmoothed Target Encoding value for category , • is the smoothing factor, • ḡlobal is the global average of the target attribute (Class) across the entire dataset.
For many models, such as Logistic Regression or Support Vector Machines (SVM), dataset standardization is essential, as these models perform better when sample values are centered around zero. Without standardization, models may face convergence issues, meaning they cannot properly learn from the The standard score, or z-score, is calculated for each sample using the formula: = −
• is the sample value, • is the mean of the training samples, • is the standard deviation of the training samples.
We compute the mean and standard deviation separately for each attribute (column) and apply these values to the samples in that attribute. To standardize our dataset, we used the StandardScaler [34] from the scikit-learn library.
Hyperparameters are model settings defined by the programmer, and optimizing them can enhance model accuracy. Tools like GridSearchCV [35] and RandomizedSearchCV [36] from scikit-learn automate the process of finding the optimal hyperparameter combination. We provide a set of hyperparameters in the input grid, and the algorithm tests various combinations to identify the best-performing one. GridSearchCV evaluates all possible combinations, while RandomizedSearchCV tests a user-specified number of random combinations, selecting the one with the highest accuracy. The latter is faster and more eficient for large sets of combinations, as it reduces computational demands.
To optimize hyperparameter selection, we employed 10-fold cross-validation, where the dataset is divided into ten equal subsets. The model is trained on nine subsets and tested on the remaining one, generating a validation score for each subset. The overall validation score is computed as the average of these scores. The hyperparameters yielding the highest average validation score are selected as the optimal configuration.
To evaluate model performance, we used cross-validation with ten subsets for each hyperparameter combination. The score for a given combination is the average of the validation scores across these subsets. Multiple hyperparameter combinations were tested, and the one yielding the highest score was selected as the final configuration.
For Logistic Regression, the optimal hyperparameters identified by GridSearchCV were: • Penalty: l1 – regularization method to mitigate overfitting. • Solver: liblinear – algorithm used for optimization in logistic regression.
• C: 1.0 – inverse of regularization strength.
For the Random Forest model, the optimal hyperparameters determined by RandomizedSearchCV were: • n_estimators: 300 – number of trees in the forest. • max_depth: None – no limit on the depth of trees. • max_features: log2 – maximum number of features considered for node splitting. • min_samples_leaf: 1 – minimum number of samples in a leaf node. • min_samples_split: 2 – minimum number of samples required to split a node. • bootstrap: False – data points are sampled without replacement.
We utilized RandomizedSearchCV to optimize the hyperparameters for the XGBoost model, resulting in the following configuration: • n_estimators: 350 – number of trees in the model. • max_depth: 100 – maximum depth of each tree. • subsample: 0.9 – proportion of data used for training each tree under Boosting. • colsample_bytree: 0.3 – proportion of features selected for each tree. • gamma: 0.3 – minimum loss reduction required to split a node. • min_child_weight: 1 – minimum number of data points in a child node. • reg_alpha: 0 – L1 regularization to reduce overfitting.
• reg_lambda: 1 – L2 regularization to reduce overfitting.
After data cleaning, preprocessing, and hyperparameter tuning, we proceeded with training and testing the models. The dataset was split into training and test sets using the ‘train_test_split‘ function [37], allocating 60% for training and 40% for testing. Initially, an 80%/20% split was used, but we adjusted to a 60%/40% split to assess model performance with a larger test set. The scikit-learn library was used to implement and train the models, except for XGBoost, which utilized the xgboost library [38]. Three models—Logistic Regression, Random Forest, and XGBoost—were defined, trained, and tested. Their performance evaluation is discussed in the following chapter.
Before building the tool, functional models were critical, as they underpinned much of its functionality. We exported the trained models to separate files using the joblib library [ 39] for integration into the tool. Additionally, we processed data for scaling and Target Encoding to ensure input data matched the format required by the models.
The tool was developed using the argparse library [40], enabling user interaction via the command line. Upon launching, users input the domain name to be classified. Relevant features, consistent with those in the training dataset, are extracted from the domain using the same feature extraction process. Categorical attributes undergo Target Encoding, and data for logistic regression is scaled using saved scaling files. The processed data is then fed into the models, which classify the input domain.
We utilized the SHAP tool to assess the importance of attributes in our dataset and to identify which attributes influenced the classification of specific samples. This approach helps pinpoint the sources of errors, such as false positives or false negatives, by highlighting the contributing attributes.
When a user inputs a domain name, relevant features are extracted to serve as input for the machine learning models. The domain is then classified by three models—Logistic Regression, Random Forest, and XGBoost—each providing its prediction on the domain’s class. A majority voting mechanism determines the final class, requiring at least two models to agree. The classification result is displayed to the user in the console, along with the key attributes influencing the decision, as determined by the SHAP method.
These techniques address the issue of imbalanced datasets, where one class has significantly more samples than another. Oversampling increases the number of samples in the minority class, while undersampling reduces the number of samples in the majority class.
Lemaître et al. [41] developed the imbalanced-learn [42] library to tackle the common problem of imbalanced datasets. This solution enhances model learning by balancing class sample counts, enabling models to better identify patterns for training. As the library is compatible with our chosen scikitlearn library, we opted to use it to increase the number of samples in the malicious domain class. After applying oversampling, we observed a slight improvement in model accuracy.
We documented the accuracy comparison in Table 1:
SHAP (SHapley Additive exPlanations) [
The results can be interpreted as follows: positive Shapley values indicate that the attribute influenced the model to classify the domain as Class 0 (benign), while negative values suggest a tendency toward Class 1 (malicious).
For the Random Forest model, only two attributes are reported. This is because SHAP is less compatible with Random Forest when analyzing a single sample (local interpretation) as opposed to the entire dataset (global interpretation), which can lead to inaccuracies. An alternative approach would be to use the feature_importance_ method [43], which, unlike SHAP, does not indicate the direction of influence toward a specific class but only quantifies the attribute’s overall role in classification.
After training the models on our preprocessed dataset, we evaluated their performance using 10-fold cross-validation, which provides the average accuracy of each model. The results are shown in Table 3:
From these results, we can conclude that the Random Forest (RF) and XGBoost (XGB) models performed best. If we were to redesign the tool to use only one model, we would likely choose either Random Forest or XGBoost.
In Table 4, we evaluated the models using various metrics during a single measurement. The results show that Random Forest (RF) and XGBoost (XGB) again outperformed, though Logistic Regression (LR) also achieved respectable results. The main issue with Logistic Regression is a slightly higher number of false negatives (FN) compared to false positives (FP). For our purposes, it is preferable for a model to erroneously classify a domain as malicious (FP), as such cases can be manually verified. However, if a malicious domain is mistakenly classified as benign (FN), it may not undergo further scrutiny, potentially remaining publicly accessible and posing an ongoing threat.
To evaluate the performance of a classification model several metrics are used [
We applied the trained models within our CLI tool, where the user writes the name of the domain they want to analyze. The result is a classification of the domain by all three models and their voting for the domain class. In addition to the class, the tool also returns the attributes according to which it classified the domain.
The dataset could be enlarged by analyzing new domains, which could also be used in other works. In the future, we could also supplement the analysis with other attributes and classification into multiple classes, e.g. phishing, malware, C&C and others. Another functionality that could be beneficial for the tool in the future could be the analysis of page content using Natural Language Processing.
This paper was supported by the Slovak Research and Development Agency under contract No. APVV23-0137 .
The authors have not employed any Generative AI tools. Brief 38 (2021) 107342. URL: https://www.sciencedirect.com/science/article/pii/S2352340921006260. doi:https://doi.org/10.1016/j.dib.2021.107342. [22] SK-NIC, Spoločnosť sk-nic, 2025. URL: https://sk-nic.sk/, accessed: 2025-04-19. [23] A. Lavrenovs, F. J. R. Melón, Http security headers analysis of top one million websites, in: 2018 10th International Conference on Cyber Conflict (CyCon), IEEE, 2018, pp. 345–370. [24] R. Haldar, D. Mukhopadhyay, Levenshtein distance technique in dictionary lookup methods: An improved approach, 2011. URL: https://arxiv.org/abs/1101.1232, arXiv preprint arXiv:1101.1232. [25] A. M. Almuhaideb, N. Aslam, A. Alabdullatif, S. Altamimi, S. Alothman, A. Alhussain, K. A. Alissa, Homoglyph attack detection model using machine learning and hash function, Journal of Sensor and Actuator Networks 11 (2022) 54. [26] A. D. Wong, Detecting domain-generation algorithm (dga) based fully-qualified domain names (fqdns) with shannon entropy, 2023. URL: https://arxiv.org/abs/2304.07943, arXiv preprint arXiv:2304.07943. [27] Let’s Encrypt, Let’s encrypt, 2025. URL: https://letsencrypt.org/, accessed: 2025-04-19. [28] Google, Google trust services, 2025. URL: https://pki.goog/, accessed: 2025-06-22. [29] Slovenská obchodná inšpekcia, Zoznam podvodných internetových stránok, 2025. URL: https: //www.soi.sk/sk/informacie-pre-verejnost/internetove-obchody/podvodne-internetove-stranky-1. soi, accessed: 2025-04-19. [30] Ministerstvo na kontrolu, Zoznam falošných e-shopov a phisingových stránok, 2024. URL: https: //mnk.sk/fake/, accessed: 2024-03-07. [31] Python Software Foundation, Projekt requests, 2025. URL: https://pypi.org/project/requests/, accessed: 2025-04-19. [32] pandas development team, Projekt pandas, 2025. URL: https://pandas.pydata.org/, accessed: 202504-19. [33] scikit-learn developers, class targetencoder, 2025. URL: https://scikit-learn.org/stable/modules/ generated/sklearn.preprocessing.TargetEncoder.html, accessed: 2025-04-19. [34] scikit-learn developers, class standardscaler, 2025. URL: https://scikit-learn.org/stable/modules/ generated/sklearn.preprocessing.StandardScaler.html, accessed: 2025-04-19. [35] scikit-learn developers, Modul gridsearchcv, 2025. URL: https://scikit-learn.org/stable/modules/ grid_search.html, accessed: 2025-04-19. [36] scikit-learn developers, Modul randomizedsearchcv, 2025. URL: https://scikit-learn.org/stable/ modules/generated/sklearn.model_selection.RandomizedSearchCV.html, accessed: 2025-04-19. [37] scikit-learn developers, Modul train_test_split, 2025. URL: https://scikit-learn.org/stable/modules/ generated/sklearn.model_selection.train_test_split.html, accessed: 2025-04-19. [38] XGBoost project, Projekt xgboost, 2025. URL: https://xgboost.readthedocs.io/en/stable/install.html, accessed: 2025-04-19. [39] Joblib project, Projekt joblib, 2025. URL: https://joblib.readthedocs.io/en/stable/, accessed: 2025-0419. [40] Python Software Foundation, Projekt argparse, 2025. URL: https://docs.python.org/3/library/ argparse.html, accessed: 2025-04-19. [41] G. Lemaître, F. Nogueira, C. K. Aridas, Imbalanced-learn: A python toolbox to tackle the curse of imbalanced datasets in machine learning, Journal of Machine Learning Research 18 (2017) 1–5. [42] imbalanced-learn project, Projekt imbalanced-learn, 2025. URL: https://imbalanced-learn.org/, accessed: 2025-04-19. [43] scikit-learn developers, Metóda feature_importance_, 2025. URL: https://scikit-learn.org/stable/ auto_examples/ensemble/plot_forest_importances.html, accessed: 2025-05-05. SSL_Issuer DMARC AS HTTP_Status Vowel_Ratio Numerical_Ratio Special_Char_Ratio Vowel_Sequence Consonant_Sequence Numerical_Sequence Special_Char_Sequence Is_Unicode Levenshtein_Distance Contains_Blacklisted Last_is_invalid
Description All sources are published on GitHub Github CLI Project .