OpenPhish Analysis Dashboard

Automated phishing scan results - December 2025

📄 output_OpenPhish_dec_2025.xlsx 📊 299 URLs 🕓 Generated 2026-03-09 15:48
1 — KPI Summary
Total URLs
299
All first-pass scans
Malicious
51
Visual verdict
Safe
245
Visual verdict
Unknown
3
Undetermined
With Log Data
136
45% of total
Blocklist Hits
82
Log-based verdict
Mismatches
31
Visual ≠ Log verdict
Login Forms
132
login_detected = YES
Input Elements
158
Any Input = Yes
Active URLs
296
2 timeout • 1 error
Unique Brands
20
From brands_summary
Avg Scan Time
24.8s
Median 15.1s
2 — Detection Overview 299 rows

Visual Detection Verdict

n=299

Log-Based Verdict

n=136 rows with logs

URL Status

n=299

Visual vs Log Verdict (Heat-Map)

n=136 rows with both verdicts

Input Elements by Visual Verdict

n=299

3 — Timing Analysis 299 rows

Delta_Time Distribution (buckets, seconds)

n=299

Scan Duration by Verdict (Box Plot)

n=299

Mean Scan Time by Hour of Day

n=299

Timing Summary by Verdict

VerdictNMean (s)Median (s)Min (s)Max (s)
Malicious5140.6735.4232.2480.47
Safe24517.6614.092.53163.36
Unknown3342.36395.5590.01541.53
4 — Logs vs Visual Detection 136 rows

UrlDecision vs Visual Verdict

n=136

login_detected vs Visual Verdict

n=136

Verdict Mismatches — Visual Safe ≠ Log Malicious  31 rows

All 31 mismatches are sites where the visual scan returned Safe but the log returned Malicious / Blocklist. These are potential false negatives requiring manual review.
URLDetectedDetected by logsUrlDecisionPhishScore
https://courierguy-thedelivery-southafrica.pages.dev/pag1_files/saved_resource(1).html/SafeMaliciousBlocklist40.0
https://aptos-web-git-chore-shows-the-staking-token-website.pancake.run/pools/history/SafeMaliciousBlocklist40.0
https://roblox.com.ge/users/3492633878/profileSafeMaliciousBlocklist40.0
https://www.robiox.com.py/users/459514889210/profileSafeMaliciousBlocklist70.0
https://productbnk-tech.github.io/my-web/SafeMaliciousBlocklist70.0
https://www.roblox.com.ml/users/4963799567/profileSafeMaliciousBlocklist40.0
https://roblox.com.ly/communities/5024353694/SafeMaliciousBlocklist60.0
https://hr.bulletinshr.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380SafeMaliciousBlocklist60.0
https://santander.es-lineasegura.com/SafeMaliciousBlocklist60.0
http://roblox.com.ml/communities/9199672745/Cherrys-GroupSafeMaliciousBlocklist60.0
http://roblox.com.ml/communities/2329024045/AdoptMe-Fan-GroupSafeMaliciousBlocklist60.0
http://iqtkt.com/uSafeMaliciousBlocklist60.0
http://ictd.printertroubleshoot.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380SafeMaliciousBlocklist60.0
https://n4.home.fedricfamily.com/cgi-bin/home.haSafeMaliciousBlocklist60.0
https://www.hivcpvrbbd.my/SafeMaliciousBlocklist60.0
https://robloxy.com.es/games/16146832113/9-0-Anime-Vanguards?privateServerLinkCode=55688059124214164010685277129552SafeMaliciousBlocklist70.0
https://mohamed-giza.github.io/facebook-project/SafeMaliciousBlocklist70.0
https://manjusinghak.github.io/Amazon-Clone/SafeMaliciousBlocklist70.0
https://roblox.com.py/users/9701593562/profileSafeMaliciousBlocklist60.0
http://amazon.cqzs.shop/SafeMaliciousBlocklist60.0
http://tinyurl.com/44vs7r2aSafeMaliciousBlocklist60.0
https://shortlink.st/SbOvLX-zSafeMaliciousBlocklist60.0
https://olx-otrzym.cfd/o/qpp4h/1765272322020#selectedbank9SafeMaliciousBlocklist60.0
https://ipfs.io/ipfs/bafybeielk62toivswjg5inihpku5bxg63ud3lsharmkvoffmr7ppsoclfa/SafeMaliciousBlocklist70.0
https://www-rqblox.com/users/85772843/profileSafeMaliciousBlocklist60.0
https://bertiecottage.flonix.net/wp-admin/css/colors/modern/swisspasssbbcfs/SafeMaliciousBlocklist60.0
http://vibrant-assistant-154379.framer.app/SafeMaliciousBlocklist70.0
https://janatalamani.ae/credicoop/crediklon/empresa.htmlSafeMaliciousBlocklist60.0
https://tx1015.com/77tg/index.php?email=3mail@a.b.c0SafeMaliciousBlocklist60.0
https://dev-affan.github.io/Amazon/SafeMaliciousBlocklist70.0
https://richsnvail2cdwzf8ududchbc50xnyvpa5cjcows.surge.sh/home.htmlSafeMaliciousBlocklist60.0
5 — Brand Analysis 20 brands detected

Top Impersonated Brands (brands_summary sheet)

Source: brands_summary sheet • 89 total brand detections

Brand Count Table

BrandCount
Netflix16
EMS13
M15
Lenovo4
Microsoft4
Adobe3
Comcast3
1Password2
Amazon2
Ebay2
FSHK2
Google2
Hkbea2
HSBC2
IBM2
Intel2
Nike2
Oracle2
PayPal2
Philhealth2
6 — PhishScore Analysis 136 rows
PhishScore takes only 3 discrete values: 40, 60, 70 - indicating a tier-based model, not a continuous score.

PhishScore Tier Distribution

n=136

PhishScore vs UrlDecision

n=136

PhishScore by Visual Verdict

VerdictNMeanMedian
Malicious5160.9860.0
Safe8547.5340.0
8 — Data Quality Notes

Column Coverage (% non-null)

Key Data Quality Observations

  • ▶"Already scanned?" = "No" for all 299 rows — clean first-pass dataset with zero re-runs.
  • ▶Log fields (PhishScore, UrlDecision, brand, etc.) populated for only 136/299 rows (45%). Remaining 163 rows generated no log output.
  • ▶PhishScore takes exactly 3 values: 40, 60, 70. Likely a tier label, not a gradient.
  • ▶final_brands has 10 pipe-separated multi-brand rows (e.g., "Netflix | SHEIN | Intel").
  • ▶Analyst comment columns are 6–18% populated; 56 URLs reviewed manually.
  • ▶1 URL raised a hard Error; 2 were Timeout. Exception Info recorded for 3 rows.
  • ▶Sheet1 is empty. incorrect brands sheet has QA notes on mis-classified logo detections.
Analyst Insights

🔍 Key Findings & Recommendations

  • 299 URLs scanned ג€” all fresh (none previously scanned). 136 (45%) generated log output; 163 produced no logs.
  • Visual detection: 51 Malicious, 245 Safe, 3 Unknown.
  • Log-based detection: 82 Blocklist, 54 Allowlist across 136 logged rows ג€” these align with Malicious/Safe respectively.
  • 31 verdict mismatches detected: all are Safe (visual) vs Malicious (log). These are probable false negatives in the visual scanner and warrant manual review.
  • PhishScore uses only 3 discrete tiers ג€” 40 (61 rows), 60 (54 rows), 70 (21 rows) ג€” suggesting a label-based scoring scheme, not a continuous gradient.
  • Malicious sites take nearly 2ֳ— longer to scan (mean 40.67s) vs Safe sites (17.66s), likely due to heavier JS payloads or redirects on phishing pages.
  • login_detected=YES fires on 132 of 136 logged rows, but only 51 are truly Malicious ג€” login-form presence alone is not a reliable classifier.
  • Top impersonated brands: EMS (16), Netflix (13), M1 (5). 10 rows contain multi-brand detections (pipe-separated).
  • 3 non-Active URLs ג€” 2 Timeout, 1 Error. Exception Info recorded for 3 rows.
  • Analyst comments cover 56 URLs across 6 reviewer columns. Sheet1 is empty; 'incorrect brands' sheet documents logo mis-classifications.