What my numbers mean

These distinctions are the point. Most published threat statistics blur them.

Live

Independently checked by my own monitoring and currently serving malicious content — not merely present on a feed.

Reported

An abuse submission was actually filed with the responsible provider, registrar or platform.

Taken down

The monitored URL subsequently became unavailable or stopped serving the phishing content.

Attributable

I reported the site and my monitoring confirms it is no longer serving. Attribution is by timing — removal follows the report — and is strongest for fast takedowns. Unless a provider tells me, I do not know who removed it.

Not counted

Phishing I never reported, or that went offline before I filed, and removals my own records show were not my report's doing. A site that goes offline on its own after my report is counted, because I cannot tell the two apart.

Excluded

Reports whose removal time was not recorded when it happened (records I added or corrected afterward), and 1,891 reports emailed in June and July 2026 to a Cloudflare abuse mailbox that Cloudflare does not read — it acts only on its web form, which is how every Cloudflare report has been filed since. A report nobody received is not counted as filed, and a site that went offline after one is not counted as mine. My removal rates and timings also leave out reports that do not ask for a page to come down (video, account and public-warning-list filings); those still count as reports filed.

All figures

Recomputed automatically from the live system every 30 minutes.