via blacklisting, many attackers made minor modifications to the original URL. They proposed to extend the blacklist by deriving new URLs based on five heuristics including: Replacing Top-Level Domain (TLDs), IP Address Equivalence, Directory Structure Similarity, Query String substitution, and brand name equivalence. Since, even a minor mismatch from the blacklist database can cause a malicious URL to go undetected, they also devised an approximate matching solution. Similar heuristics potentially could be used when deriving blacklist features for machine learning approaches. A similar methodology was adopted for automated URL blacklist generation by [@sun2015autoblg; @bo2016automating]. [@felegyhazi2010potential] developed a method to proactively perform domain blacklisting.

Lexical Features
----------------

Lexical features are features obtained based on the properties of the URL name (or the URL string). The motivation is that based on how the URL “looks” it should be possible to identify malicious nature of a URL. For example, many obfuscation methods try to “look” like benign URLs by mimicking their names and adding a minor variation to it. In practice, these lexical features are used in conjunction with several other features (e.g. host-based features) to improve model performance. However, using the original URL name directly is not feasible from a machine learning 