Transparency

A warning tool is only worth trusting if you can check how often it cries wolf. We measure that and show the numbers.

Numbers you can reproduce View source

Show the numbers

Our promises

It warns, it never blocks. You decide.
It runs on your device. The default checks need no internet.
There is no server. Nothing about the page you are on reaches us.
The online checks (threat-list updates, domain age, Google Safe Browsing) stay off until you turn them on, and each sends only the one thing it needs.

What we detect

Eight families of signal, combined into one score.

Brand impersonation. Misspelled or look-alike versions of well-known sites.
URL tricks. Raw IPs, the @ trick, high-abuse endings, long subdomain chains, digit-heavy names.
Known-bad lists. A bundled blocklist plus a daily feed, matched on your device.
Page checks. A login form on an unknown site, and device-code sign-in scams.
On-device model. Random, computer-generated addresses.
AiTM. A sign-in or code prompt on a site that does not match the brand it looks like.
Scam packs. Wallet recovery-phrase requests and fake tech-support pages.
Google Safe Browsing. An extra layer, if you add your own free key.

Measuring false positives

A false positive is a warning on a site that is fine. We count the loud ones, high and critical. The address-only engine runs over the first 100,000 domains of the Majestic Million, a public list of the most-linked sites, and the rate is high plus critical warnings divided by domains scanned.

Reproduce it

The audit prints every site it flagged:

node scripts/fp-audit.mjs

Add --selftest to check the harness on a small built-in set, --limit N to scan fewer domains, or --cache to reuse a downloaded corpus.

Latest result

Run of 19 August 2026, 100,000 legitimate sites. The 11 August run had the same numbers.

Low99,912 (99.9%)
Elevated88 (0.088%)
High0
Critical0

False-positive rate 0%, 0 in 100,000, after the August 20 model update; 88 sites show the quieter yellow level.

Method, command, flagged domains and run history are on the benchmark page.

What it catches

The other side of the coin: 392,233 live phishing hosts from the three public feeds on 20 August 2026, rated by address alone with the known-bad lists switched off, so this is what the heuristics and the on-device model catch before a site is on any list.

Low105,703 (27.0%)
Elevated243,669 (62.1%)
High33,095 (8.4%)
Critical9,766 (2.5%)

73.0% show at least an elevated signal and 10.9% a high or critical warning from the address alone. The known-bad lists, updated daily, catch the rest; most misses are ordinary-looking names on free hosting.

Report a mistake

If Fish Catcher warns about a good site, or misses a bad one, open an issue. Real examples improve the lists and the model.

BackPrivacy NextBenchmark