Global edge (Cloudflare)
Most lookups start here. Responses can vary with the target, resolver and observation location.
Methodology & accuracy
It is easy for a security tool to say "safe". We never say it. Instead, this page shows what each verdict rests on, where we looked from, and how often we turned out to be wrong when we measured it.
Principles
- We never call anything "safe". The best possible result is "no warning signs found".
- Every warning shows its reasons. Verdicts we cannot explain (such as an AI model deciding alone) are not used.
- The tool and lookup path determine which vantage points are used. Paths with both edge and Seoul responses compare them; not every lookup runs from both places.
- Only public information is looked at. Messages you paste are never stored.
- We never single out an organisation. Statistics are published as sector-level shares only.
Where we observe from
Seoul vantage point
Korean sites that drop foreign connections (many public-sector sites) are re-checked from Seoul. Phishing links are followed from Seoul as a Korean phone would; when the destination differs from what a visitor abroad gets, it is flagged as possible cloaking.
Phishing & smishing link check 610 legitimate sites (647 addresses) · 416 phishing sites
0 / 610legitimate sites wrongly called "danger" (in the measured sample)
2.2%legitimate free-hosting sites called "suspicious"
22–86%real phishing sites warned from the link alone (danger or suspicious, by source, site level)
We ran legitimate sites and real phishing links through the same rules and counted. Feed listings were switched off (matching the feed would prove nothing) and only the link (URL) was given.
| Sample | Size (legitimate: addresses) | Warned (danger + suspicious) | Danger |
|---|---|---|---|
| Legitimate: Korean institutions and major brands | 223 | 0 | 0 |
| Legitimate: popular sites on free hosting (Tranco top 1M) | 320 | 6 (1.9%) | 0 |
| Legitimate: real login pages (Korean banks, cards, shops, government; global services) | 104 | 0 | 0 |
| Phishing: a public suspicious-phishing list (phishunt, CC0), held-out, list match off | 150 sites | 127 (85%) | 104 |
| Phishing: a differently collected list (TweetFeed, CC0 — researcher posts), held-out | 174 sites | 49 (28%) · 38% of reachable | 18 |
| Phishing: a fresh phishunt sample (final 11 October rules, no site shared with earlier samples) | 92 sites | 85 (92%) | 70 |
| Phishing: 17 October held-out phishunt sample (rules 12, no site shared with earlier samples) | 109 sites | link alone 94 (86%) · with Google Web Risk, as the service runs: 94% | 73 |
| Phishing: 17 October held-out TweetFeed sample (rules 12) | 136 sites | link alone 30 (22%) · service: 59% | 8 |
- Of 647 legitimate sites (104 of them real login pages), none was judged "danger". When you see "danger", the reasons are clear-cut.
- From the link alone (list match off), 85% of 150 real phishing sites held out from rule-writing drew a warning (69% on the same sample with the rules before 10 October; 83% on two earlier held-out samples). Lists carry one campaign's many sub-addresses, so we count sites. The live service also warns ("suspicious") on addresses on that list. On a differently collected list (TweetFeed — links posted by researchers) it was only 28% (38% of reachable sites); phishing aimed at Japan that shows a blank page to visitors abroad is the weak spot. Results vary a lot by source, so both lists are re-measured monthly on fresh samples. With the final 11 October rules, a fresh phishunt sample of 92 sites sharing no site with earlier samples came out at 92%. On the 17 October held-out samples (rules 12) the link alone caught 86% on phishunt and 22% on TweetFeed; adding Google Web Risk listings, as the live service does, gives 94% and 59% (no legitimate site listed). A 12 October improvement that lifted TweetFeed to 49% on another sample did not hold up on the fresh one.
- The page is first read as text (512KB of HTML and up to five of the site's own scripts); links that leaves undecided are opened in a headless browser in Seoul to see what the scripts draw (nothing is clicked or typed). Links that look aimed at Japan are opened once more as a Japanese phone from Tokyo, and a link that shows Korean and Japanese phones different sites is flagged as cloaking. Pages shown only to one carrier's mobile IPs can still be missed.
- A link once judged "danger" is remembered for good: the same link, and other links on the same attacker-made address, keep the warning even after the page goes down or turns blank.
- When you paste the whole message, the combination of a lure ("delivery", "refund", "account locked") and the link is read too. That path is not measured yet: there is no public sample of real messages.
- A free-hosting address alone is not a warning — plenty of personal blogs and projects live there. We warn only with evidence: a login form, a lure word, a brand name.
- Pages shown only to certain phones or regions can be missed.
Exposed admin page check 61 Korean institutions · 27 risky screens
23 / 27risky classifications that were right (85%)
4wrong — all decided from the hostname alone
—missed exposures (recall) cannot be measured
- From the records of 61 Korean institutions, a person checked each of the 27 screens classified as risky. 23 (85%) were right.
- All 4 misses were classified from the hostname alone (a business-customer service taken for an internal system, groupware for remote access). Hostnames alone no longer decide: the page itself has to show it.
- Admin screens, developer tools and directory listings did not occur in this sample, so their accuracy is not measured yet.
- Missed exposures (recall) cannot be measured: hosts that never appear in certificate records and the like are not seen at all.
All-in-one health score rules 2 · 2026-10-17
- Five questions carry the weight: web connection — certificate 20, HTTP security headers 15 / mail spoofing defence 20 / domain registration 8, DNS 12 / exposure 15 / reputation 10.
- In each area a warning costs 25% of its weight and a critical 50% (up to the area's weight). Grades: A+ 90+ · A 80+ · B 70+ · C 50+ · D 40+, below that F.
- A domain that uses no mail (no inbound MX and no sign of sending) is not judged on mail-server features, only on whether it tells receivers to reject mail sent in its name (SPF "-all", DMARC quarantine or reject) — as the UK NCSC and US CISA BOD 18-01 advise.
- When the domain has no address and only www does, the website is measured on www. When neither has one, the web connection does not apply and the rest is rescaled.
- Data that could not be read in full is flagged, not charged. A failed exposure or reputation lookup is "not checked" and left out; a failed web, mail, DNS or registration lookup costs the area's full weight (a site that blocks our checks must not score higher).
- DNS propagation, reverse DNS, ASN and open ports are shown for reference only: measured on 167 Korean institutions, they were nearly always full marks and only diluted the score.
Security hygiene index
- A fixed list of public websites per sector is observed weekly with the same tools. The monthly index counts each site's latest observation of the month only.
- A metric is not published for a sector with fewer than 10 measured sites. Site names are never published.
- When a rule changes, its version goes up, and observations under different versions are never compared as a "change".
- The DMARC metrics (set; enforcing policy) count domains that use no mail too: the question is whether spoofed mail in the domain's name is stopped, and an enforcing policy (p=reject) is advised for domains that send no mail as well (UK NCSC, US CISA BOD 18-01).
Measurement log
| Date | What changed |
|---|---|
| 2026-10-05 | First published measurement — numbers after fixing what the measurement itself exposed (a government domain mistaken for a lookalike, brands' own short links, blanket warnings on free hosting, hostname-only exposure classes). |
| 2026-10-10 | Re-measured after the rule update: wider page reading (512KB and the site's own scripts, host block screens, Telegram-bot exfiltration, brand-dressed logins, brand misspellings and more) and 104 real login pages added to the legitimate sample. On a sample not used to write the rules: 83% of phishing sites warned (69% before), still no legitimate site of 647 called "danger". After checking the lists' terms the same day, figures measured on a list whose terms do not allow commercial use were removed from this page. |
| 2026-10-11 | Studied the misses on a list we may use commercially (phishunt, CC0) and tightened the rules (an "@" disguise bug fixed, brand labels, misspellings, suspended hosting and more). 85% of 150 held-out sites warned; still no legitimate site of 647 called "danger". |
| 2026-10-11 | Added a second render as a Japanese phone from Tokyo for links aimed at Japan, a cloaking-by-country signal, and fixed evidence lost when two views were merged. A fresh phishunt sample of 92 sites sharing no site with earlier samples: 92% warned; legitimate 647: no "danger" (6 free-hosting sites "suspicious", 1.9%). |
Samples: a public suspicious-phishing list (phishunt, CC0), the Tranco popular-sites list, public institution and company homepages and login pages. Measured 2026-10-17.