Phishing detection benchmark
Most phishing-check services do not publish how accurate they are. Every month we re-measure ours on fresh phishing samples the rules never saw, and publish what we caught and what we missed at the same size.
How many real phishing sites were caught
| Sample | Sites | Service warned | Link alone (danger or suspicious) | 95% interval | Of reachable | Of live pages | Danger |
|---|---|---|---|---|---|---|---|
| phishunt (CC0, a public suspicious-phishing list) | 109 | 93.6% 87.3–96.9% | 86.2% 94 | 78.5–91.5% | 86.2% | 87.9% | 73 |
| TweetFeed (CC0, links posted by researchers) | 136 | 58.8% 50.4–66.7% | 22.1% 30 | 15.9–29.7% | 29.7% | 38.2% | 8 |
Were legitimate sites wrongly warned
| Legitimate sample | Sites | Danger (false alarm) | Suspicious |
|---|---|---|---|
| Korean company, institution and brand home pages | 189 | 0 | 0 0% |
| Real sign-in pages | 101 | 0 | 0 0% |
| Legitimate sites on free hosting | 320 | 0 | 7 2.2% |
Phishing aimed at Korea
No figure yet. Public phishing lists we may use commercially carry almost no phishing aimed at Korea (none in the October sample), and public bodies do not publish phishing URL lists. So we check the Korean-brand lookalike names we discover the moment we first see them, and count as phishing only those a third party later confirms — a registry hold or a host's block page. The figure appears here once at least 50 confirmed sites have been collected.
For reference
- AV-Comparatives certifies anti-phishing protection that blocks at least 85% of new phishing URLs without blocking any legitimate (banking) site. Our goal is the same bar: 85% or more on both samples, and no legitimate site called "danger".
- Two figures are shown. "Link alone" is our rules' verdict (public phishing list matching off); "Service warned" adds a Google Web Risk listing, as the live service does (a listing counts as "suspicious"). Certified products are tested with their blocklists, reputation and user telemetry. Web Risk is asked on the day we measure, which can be up to seven days after a link was posted, so it may list more than it would right after posting.
- We do not measure other products ourselves until their terms allow comparative testing.
How it is measured
- On the 1st of each month, new items sharing no site with earlier samples are drawn from both public lists and checked with the same rules as the service (a Korean phone render from Seoul, and a Japanese phone from Tokyo for links aimed at Japan).
- Lists carry one campaign's many sub-addresses, so we count sites. Warned = "danger" or "suspicious".
- "Of live pages" counts only sites where the renderer got a normal answer (below 400): phishing taken down before the measurement cannot be seen by anyone.
- Intervals are Wilson 95% intervals; small samples give wide ones.
- Published figures are the first measurement, before any rule change. Misses may then be studied to improve the rules, but a sample once looked into is never used for a published figure again.
By month
| Month | phishunt | TweetFeed | Legitimate "danger" |
|---|---|---|---|
| 2026-10 | 86.2% | 22.1% | 0 / 610 |
Phishing link check → Methodology and the accuracy of the other tools →