Data sources
Plumbline earns money, so every feed was checked for commercial-use terms before it was used. Sources that did not allow it were left out.
Used
| Source | Used for | Terms |
|---|---|---|
| Phishing.Database | A list of known phishing domains. A match is hard evidence. | MIT licence, which allows commercial use. Copyright the Phishing.Database contributors. Only hashes of domains are kept. |
| Registry RDAP services (via the IANA bootstrap) | When a domain was registered, and by which registrar. | Public registration data published by registries for this purpose. Lookups are cached for hours. |
| Cloudflare DNS over HTTPS | Resolving a host before it is opened, so internal addresses can be refused. | Free public resolver. |
| TON Center API | Wallet state, balance, first activity and recent transactions. | Used under the TON Center Terms of Use (June 2024). Raw responses are never stored; only Plumbline's own verdict is cached, for five minutes. |
| Plumbline's own heuristics | Look-alike brands and handles, address structure, page signals, activity patterns. | Original work, measured on the accuracy page. |
| Community reports | A “reported by N users” signal, shown only after several people report. | Collected by Plumbline under the privacy policy. |
Checked and not used
| Source | Why not |
|---|---|
| abuse.ch URLhaus and related feeds | Its terms limit free access to non-commercial use and say commercial use may need a paid subscription. |
| Google Safe Browsing (free API) | Free for non-commercial use only. |
| OpenPhish, PhishTank, Phishing Army | Not confirmed to permit commercial use, so they were left out rather than assumed. |
Corrections to this page, including a licence you think was misread, are welcome at joshuamhone9@gmail.com.