Open rank, page authority and popularity metrics measure how well known a site is. They do not measure whether a page on it is harvesting credentials right now — and the busiest hosting platforms on the internet prove it every single day.
Popularity is a property of a registrable domain over months. Phishing is a property of a hostname over hours.
Rank and authority scores exist to answer a marketing question: among all the sites on the internet, how prominent is this one? They are computed from links, traffic estimates and reference patterns accumulated slowly, and they are attached to a registrable domain because that is the unit brands and search engines care about. Used for what they were built for, they are perfectly sound.
Prominence, aggregated at the registrable domain, updated on a slow cycle. Every property below is a feature for its intended purpose and a defect when it is used to decide whether to let a user through.
Whether this exact hostname is standing up live phishing infrastructure today. Different unit, different clock, different failure mode — which is why it needs a different dataset entirely.
0-amazon.weebly.com is an entry; weebly.com is not, and never will be.These are unmodified entries from the published export. Read each hostname, then read its parent.
The parent is one of the best-known website builders on the internet, referenced by millions of pages and carrying whatever authority score you care to look up. The subdomain in front of it is a brand-lookalike phishing host.
weebly.com and allows it. The list sees the hostname and blocks it.Firebase hosting is a first-class developer platform, and its parent domain's reputation is effectively unimpeachable. That reputation is exactly the asset a kit operator is renting when they deploy there.
Two adjacent rows from the same export, differing only by a serial number. The naming is the fingerprint of bulk provisioning: dozens of hosts created in one session and rotated as each is taken down.
A hostname engineered to read as legitimate in a browser address bar: security vocabulary in the label, a platform suffix that resolves, and a valid certificate as a matter of course because the platform issues one automatically.
None of them requires abandoning rank data. They require putting it back in its lane.
Never collapse a lookup to the registrable domain. Doing so either misses every kit hosted on a large platform or blocks the platform itself, and both outcomes are unacceptable. Send the host exactly as it appeared.
Make presence on a verified list the signal, not absence from a popularity index. The database publishes only hosts that resolved to an active A record during the daily build, which is what makes it enforceable rather than merely indicative.
Prominence data is genuinely useful for prioritising a takedown, sizing a brand-abuse problem or triaging which incident to work first. Use it to rank your response; never use it to make the block decision.
Six properties that decide whether a signal can carry a blocking decision.
| Property | Popularity / rank data | DNS-verified phishing list |
|---|---|---|
| Unit of measurement | Registrable domain — every subdomain inherits the parent's score. | Full hostname — each host is an independent entry. |
| Update cadence | Slow by design, because prominence is a long-run measure. | Rebuilt every 24 hours and published at 04:30 UTC. |
| Handles a brand-new host | Either no data at all, or the parent's full inherited standing. | Included from the moment it is reported and confirmed resolving. |
| Proof the host is live | None — a score persists whether or not anything is served. | Active A record required, checked with 50 concurrent threads. |
| Removes stale entries | Not applicable; scores decay rather than expire. | Pruned on failure to resolve, with a daily changelog of removals. |
| Safe to drive a block | No — it answers a question nobody asked at the block point. | Yes, with a consequence proportionate to reversal cost. |
Allowing traffic because a parent domain scores well is how a kit on a free hosting platform reaches your users with every heuristic satisfied. It is not a conservative default; it is an open door with a reassuring label on it.
Ask about the hostname, require proof it is currently serving, and act proportionately on a hit. Keep prominence data for prioritising which of the resulting cases you work first — that is a job it does well.
Four patterns that show up repeatedly in architecture reviews.
No, and deliberately so. The response carries domain, is_phishing, category, dns_status, last_checked, confidence and database_size — nothing about popularity. The full schema is in the response format reference.
It is a different control with a different blind spot, and it is worth keeping. Registration-age heuristics catch the freshly bought lookalike; they do nothing at all about a subdomain created five minutes ago on a platform registered in 2007, which is where a large share of live kits sit.
Not one that hosts user-created content. Allow-listing pages.dev, web.app, firebaseapp.com or weebly.com would wave through four of the seven sample rows published in the feed. That is the single most expensive shortcut available here.
You need whatever enforcement layer you use to be able to match a full hostname. Most DNS resolvers, response policy zones and next-generation firewall URL categories already can — the constraint is usually in the transform script that loads the list, not in the appliance.
Take a day of proxy logs, keep the full hostnames, and batch them against the list. The entries that come back on well-known platforms are the ones your current controls are already letting through.
