Transparency
A warning tool is only worth trusting if you can check how often it cries wolf. So we measure that, and show the numbers.
Our promises
- It warns, it never blocks. You always decide.
- It runs on your device. The default checks need no internet.
- There is no server. Nothing about the page you are on reaches us, because there is nowhere for it to go.
- The online checks (threat-list updates, domain age, Google Safe Browsing) stay off until you turn them on, and each sends only the one domain it needs.
What we detect
Fish Catcher combines eight families of signal, all in plain terms.
- Brand impersonation. Misspelled or look-alike versions of well-known sites.
- URL tricks. Raw IP addresses, the @ trick, high-abuse endings, long subdomain chains, unencrypted logins, and digit-heavy names.
- Known-bad lists. A bundled blocklist plus a daily community feed, matched on your device.
- Page checks. A login form on a site it does not know, and device-code sign-in scams.
- On-device model. Spots the random, computer-generated addresses fresh phishing uses.
- AiTM. A sign-in or code prompt on a site whose address does not match the brand it looks like, with guardrails so real login providers do not trip it.
- Scam packs. Pages asking for a wallet recovery phrase, and fake tech-support pages.
- Google Safe Browsing. An extra layer, if you add your own free key.
Measuring false positives
A false positive is a warning on a site that is fine. The ones that matter are the loud ones, high and critical, so those are what we count.
We run the address-only part of the engine over the Majestic Million, a public list of the most-linked sites, and count how many good ones it warns about. The rate is the high and critical warnings divided by the total scanned.
Reproduce it
The audit prints every site it flagged, so you can check the number yourself:
node scripts/fp-audit.mjsAdd --selftest to check the harness on a small built-in set, --limit N to scan fewer domains, or --cache to reuse an already-downloaded corpus.
Latest result
Latest run, 2026-08-11, over 100,000 legitimate sites:
| Measure | Value |
|---|---|
| Warnings at high | 5 |
| Warnings at critical | 0 |
| Rate | 0.005% (5 in 100,000) |
The five were all very short, digit-heavy names on high-abuse endings, like hy315.cc.
For the full method, the exact command, the list of flagged domains and the run-by-run history, see the false-positive benchmark.
Report a mistake
If Fish Catcher warns about a good site, or misses a bad one, open an issue. Real examples make the lists and the model better for everyone.