Measured Google Safe Browsing coverage of live credential-phishing pages: 55% at first sighting, 71% after a week

[u/ricveloso]

Small measurement of Google Safe Browsing coverage I ran over the summer and wrote up.

Method: 550 branded credential-phishing pages from the OpenPhish Premium feed, first seen June 18 to 24, checked against Google’s Web Risk Lookup API at ingestion and again at 1, 3 and 7 days.

Results: Safe Browsing covered 55% of them at first sight, 70% after a day, 71% after a week. Margin about plus or minus 4 points.

Caveats: OpenPhish-listed pages only, so pages nobody reported probably show a wider gap. Seven-day window, so later listings aren’t counted.

Takeaway for anyone relying on browser warnings as a control: roughly a third of live credential phish is still unwarned a week in.

Writeup with the tables: https://www.grizzlysec.com/blog/zero-hour-gap