

To test a product's antiphishing capabilities, I collect a group of suspected phishing URLs from real-world e-mail and from several sites devoted to tracking such things. I set up one system protected by the product being tested; one protected by Internet Explorer's built-in antiphishing; and one protected by Norton Internet Security 2009, the current antiphishing champion. At times, I've used a fourth system protected by Firefox or Chrome, but I've stopped because they just weren't very effective.

Using a small utility I wrote myself, I launch a suspect URL simultaneously under all of the test systems and note the results. I discard any URL that any of the test systems is unable to load, that all of the systems let pass, or that I'm able to verify doesn't contain some kind of attempt to steal personal information.

I repeat this process over the course of several days, always using the freshest suspect URLs, until I have about a hundred verified phishing URLs. Different types of phishing URLs are prevalent at different times. Some days all the products fare worse than others. Rather than report the raw percentages of URLs correctly blocked, I report the success of the product being tested relative to Norton and Internet Explorer. A value like "-9%" in the Norton column means that the product's score was nine percentage points lower than Norton's. A "+10%" in the Internet Explorer column means the product scored ten percentage points higher than IE's.