{"test":"Test 4: telling phishing pages from real ones","version":"Page checker, test build 0.1","method":"Test 4: page checks we compute ourselves, on a public set of phishing and real pages","datasets":["Phishing Websites (UCI Machine Learning Repository, dataset 327): 5,849 unique pages","PhiUSIIL Phishing URL Dataset (UCI Machine Learning Repository, dataset 967): 235,370 unique addresses"],"results":{"score":0.986,"scoreMeaning":"area under the ROC curve: 0.5 is a coin toss, 1 is never wrong"},"byKindOfCheck":[{"Checks used":"Everything we compute ourselves","How many":25,"Score out of 1":"0.986"},{"Checks used":"Only what our own page fetch sees","How many":12,"Score out of 1":"0.952"},{"Checks used":"Only the certificate, DNS and registration","How many":4,"Score out of 1":"0.906"},{"Checks used":"Only the web address","How many":9,"Score out of 1":"0.815"},{"Checks used":"Only outside rankings and blocklists","How many":5,"Score out of 1":"0.745"}],"notes":["The strongest signals were the state of the page's certificate (47% of the weight) and the share of links that leave the site (24%).","From a web address's name alone, general checks scored 0.87 to 0.91 on 235,370 public addresses. So how close a name is to your brand has to do most of the work, which is what Lookalike Finder does.","One public set could be split almost perfectly by three yes or no questions about the address, because every real page in it was a bare home page. A score is only as honest as the data behind it, so we report the numbers above."]}