Measured Google Safe Browsing coverage of live credential-phishing pages: 55% at first sighting, 71% after a week
Description
A study measured the coverage of Google Safe Browsing against live branded credential-phishing pages, finding that only 55% were detected at first sighting and 71% after a week. The data was collected from 550 phishing pages reported by OpenPhish and tracked over seven days. The findings highlight a significant gap in real-time protection for users relying on browser warnings, as nearly a third of phishing pages remain undetected even after a week. The gap is due to the nature of blocklists like Google Safe Browsing, which rely on prior reporting and confirmation, causing delays in listing new phishing URLs. This gap poses a risk to users who may visit phishing sites before they are flagged by Safe Browsing.
Reddit Discussion
Small measurement of Google Safe Browsing coverage I ran over the summer and wrote up.
Method: 550 branded credential-phishing pages from the OpenPhish Premium feed, first seen June 18 to 24, checked against Google’s Web Risk Lookup API at ingestion and again at 1, 3 and 7 days.
Results: Safe Browsing covered 55% of them at first sight, 70% after a day, 71% after a week. Margin about plus or minus 4 points.
Caveats: OpenPhish-listed pages only, so pages nobody reported probably show a wider gap. Seven-day window, so later listings aren’t counted.
Takeaway for anyone relying on browser warnings as a control: roughly a third of live credential phish is still unwarned a week in.
Writeup with the tables: https://www.grizzlysec.com/blog/zero-hour-gap
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The analysis measured Google Safe Browsing's coverage of 550 branded credential-phishing pages from the OpenPhish Premium feed, first seen between June 18 and 24, 2026. At ingestion, only 55.3% of these pages were listed in Google's Safe Browsing database, increasing to 71.3% after seven days. The study highlights a zero-hour gap where newly live phishing pages are not yet on blocklists, leaving users without browser warnings during this critical period. The gap is structural, as blocklists depend on prior reporting and confirmation, and does not close fully even after a week. The study contrasts this with Grizzly's real-time detection, which flags 92.9% of these pages at ingestion. The findings suggest that relying solely on blocklists like Google Safe Browsing leaves users exposed to a substantial portion of phishing attacks during their initial live period.
Potential Impact
Users relying on Google Safe Browsing browser warnings are exposed to approximately 45% of live branded credential-phishing pages at the moment they go live, with about 29% remaining undetected even after a week. This gap increases the risk of credential theft and related fraud, as phishing pages can harvest sensitive information without triggering browser warnings during this window. The delay and incomplete coverage reduce the effectiveness of Safe Browsing as a real-time protective control against phishing attacks.
Defensive Guidance
There is no direct patch or fix for this structural limitation of blocklist-based phishing detection. Users and organizations should be aware that browser warnings from Google Safe Browsing do not cover all live phishing pages immediately or fully. Complementary real-time detection methods, such as those analyzing page content and branding (e.g., Grizzly), can provide earlier identification. Security awareness training to recognize phishing attempts and cautious behavior remain important. Monitor vendor advisories for any updates on improvements to Safe Browsing coverage.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ace60d12cdf04f65688da6b
Added to database: 10/13/2026, 16:48:17 UTC
Last enriched: 10/13/2026, 16:48:24 UTC
Last updated: 10/13/2026, 22:18:17 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.