Accuracy
These numbers come from a test that runs on every change to the detectors. They are published as measured, including the parts that are not flattering.
Measured 2026-10-21.
What was measured
The test covers the checks that need no network: the structure of the address, brand look-alikes, and Telegram handles. In real use a verdict also reads the page, checks domain age, and consults the phishing blocklist and community reports, so these figures are a floor for the product, not its full performance.
Legitimate sites
288 well-known legitimate sites were checked, chosen to include the names a detector tends to get wrong: hyphens, brand words, unusual suffixes and crypto-related sites.
0 of 288 were flagged at Caution or higher.
This set is hand-picked, not a random sample of the internet, so it shows the detectors do not trip over known tricky names, not that the false alarm rate on all sites is zero. An earlier run found a false alarm on a wallet-connection site's own domain; it was fixed and is now part of the test.
Look-alike domains
386 imitations were generated for brands with distinctive names, built the ways real look-alikes are built.
| Technique | Caught at Suspicious or higher |
|---|---|
| Look-alike letters from another alphabet | 100% (44 of 44) |
| Digits in place of letters (for example 0 for o) | 100% (44 of 44) |
| One-character typos (a dropped or a doubled letter) | 50% (39 of 78) |
| The brand's name on a different suffix | 100% (44 of 44) |
| The brand name with words like “claim” or “support” | 100% (132 of 132) |
| The brand's real domain written in front of another one | 100% (44 of 44) |
Overall, 100% (386 of 386) were caught at Caution or higher and 89.9% (347 of 386) at Suspicious or higher. A dropped letter (for example “binnce”) is deliberately held at Caution, because a missing letter can also be an ordinary short word.
Brands whose names are common words (for example “Gate” or “Wallet”) are not matched by name, by design, since doing so would flag many innocent sites.
Telegram handles
100% (19 of 19) impersonating handles (look-alike spellings, bots carrying a real account's name, “support” and “claim” variants) were flagged, and 0% (0 of 23) ordinary handles and the real accounts were wrongly flagged.
Real phishing domains, by name alone
5,000 domains were sampled from Phishing.Database's list of active phishing domains. Judged only by the structure of the name and brand look-alikes, 5.7% (283 of 5000) reached Caution and 0.7% (35 of 5000) reached Suspicious.
That is low, and it is the most important number on this page. Most real phishing is hosted on random, hacked or throwaway domains whose names look innocent. Plumbline relies on other evidence for those: what the page asks for, how new the domain is, and the blocklist itself.
Domain age is one of those signals. Among 115 sampled listed phishing domains whose registration date could be read, 1.7% (2 of 115) were under 30 days old and 3.5% (4 of 115) under 90 days. Among the 217 legitimate sites whose date could be read, 0% (0 of 217) were under 30 days old. A young domain is a clue, never a verdict. Listed phishing sites are often older sites that were hacked, so age is a weak clue for them; it helps most with brand-new pages that are not on any list yet, which a list-based sample cannot show.
What this does not tell you
- It does not measure the page checks, which need a live site. A fresh phishing page on a random domain is caught by what it asks for (a seed phrase, a wallet connection, a password), its age, or the blocklist, not by its name.
- The generated look-alikes are the techniques the detectors were built to find, so they are easier than the full variety attackers use.
- Plumbline will miss things. That is why results say what was checked and never claim safety.
If you find a mistake, use the “Wrong result?” button in the bot or write to joshuamhone9@gmail.com. Confirmed mistakes are listed in the corrections log.