This study presents a theoretical-informational analysis of URL characteristics to identify the most relevant and least redundant attributes for phishing detection in the Indonesian top-level domain (.id). Using Mutual Information (MI), Information Gain (GI), and Maximum Relevance with Minimum Redundancy (MRRM), this study systematically evaluates 83 lexical, structural, and entropy-based features extracted from legitimate and phishing URLs in the Indonesian domain space. The results reveal distinct patterns that consistently characterize local phishing attempts. Higher relevance scores are dominated by path-based attributes (such as path depth, symbol frequency, and digit concentration), indicating the attackers' strong reliance on deeply nested and irregular directory structures. Entropy-based features in URL components, domains, and paths also prove prominent, reflecting the widespread use of scrambled and obfuscated lexical sequences as key evasion strategies. Further optimization by RMRM indicates that some highly relevant features exhibit redundancy, while certain host-level descriptors retain unique discriminatory value. These findings offer a solid, data-driven foundation for understanding the structural signals most closely associated with phishing behavior in Indonesian TLDs. By mapping the relevance-redundancy landscape of key URL attributes, this study lays the groundwork for the future development of lightweight, interpretable, and feature-based phishing detection models specifically calibrated for the Indonesian cyber ecosystem.