PhishClean detection numbers

Measured automatically every day on live pages, and published here whether the numbers are good or bad. These figures cover the page checks on their own, with the reported-phishing list switched off, so they show what PhishClean catches before a site is on any list.

How this is measured

Every day at 03:40 UTC an automated job opens two sets of pages in a real Chrome browser with the current PhishClean release installed.

• Phishing pages: a random sample of 50 of the newest verified phishing URLs from PhishTank’s list of pages that were still online at its last hourly check, one per host. PhishClean’s own reported-phishing list is switched off for this test, so a catch comes from the checks that read the page itself: fake login forms, forms that send passwords to another domain, lookalike domains and the rest. Pages count only if they load and ask for credentials. Pages that have been taken down or parked are left out.
• False alarms: 25 real sign-in pages (Google, Microsoft, PayPal, Apple, banks, exchanges and others) and a random set of the most visited websites from the Tranco top 1,000. Any warning on these is counted as a false alarm, and the site is named in the data.
• Control: each run first opens a known fake login page. If PhishClean doesn’t catch it, the run stops and nothing is published, so a quiet day can’t hide a broken test.

What these numbers don’t show

• Real-world protection is higher than the catch rate here. In everyday use the reported-phishing list (about 380,000 sites) is switched on as well, and your browser’s own Safe Browsing or SmartScreen keeps working alongside PhishClean.
• Daily samples are small, so one day can swing. The 30-day figures are the ones to read.
• Some phishing kits hide from automated browsers and show a blank page. Those count as “not live”, so the test can’t judge them either way.
• Phishing URLs come from PhishTank (data licensed CC BY-SA 2.5); popular sites from the Tranco list. This is our own measurement, not an independent lab test. The raw data is public: /transparency.json.

Page published 2 November 2026. The figures above update daily.