# Pre-election phishing counts: method and limits

Prepared on 26th October 2026. This note supports
[the measurement article](https://sandfi.sh/blog/brazil-phishing-observation-trend).
The [aggregate JSON](https://sandfi.sh/blog/brazil-phishing-observation-trend/counts.json)
contains the source rows used below. It reproduces the arithmetic, not the
underlying case review. It contains no individual submission or private record.

## Population and clock

The primary population includes public submitted-URL analyses with execution
kind `CAPTURE`, attempt number 1, no prior analysis, no derived parent, and a
direct feed record with `intake_kind=automatic_feed`. Failed and incomplete
captures remain in the denominator. The distinct analysis join excludes
duplicate feed-provenance records that created no analysis. Each selected
analysis has its own group.

Creation time dates local admission. It does not date provider discovery,
domain registration, attack start, or victim activity. Repeated deployments
can have different URLs, so these are not unique-deployment counts.

The retained cohort ends at `2026-10-24T11:33:28Z`, exclusive. The article uses
two complete UTC weeks: 10th–16th and 17th–23rd October 2026. The primary weekly
comparison therefore ends at `2026-10-24T00:00:00Z`, exclusive. The partial day,
research captures, archive refreshes, generated invoices, and later evaluations
add no arrivals to those weeks.

The read-only measurement transaction is dated 24th October 2026,
19:10:50.090116 UTC. It applied the fixed earlier admission cutoff.

## Labels and selection

The investigation reviewed 482 selected candidates: 480 from October and two
September controls. Final labels were 64 confirmed Brazil phishing, 42 plausible,
207 legitimate-content, 65 non-Brazil, and 104 indeterminate. A disclosed banking
simulation was corrected from confirmed to indeterminate before these totals.

The weekly numerator uses only confirmed labels among that week's eligible
automatic admissions. Plausible cases remain a separate category. These are
retrospective judgments from available evidence, not the classification at the
time of arrival. The article's combined-label check adds confirmed and plausible
counts without treating the plausible cases as confirmed.

Review selected candidates using relevant terms and available evidence. It was
not a random sample. Deep review covered 121 of 4,472 earlier admissions and
261 of 7,494 later admissions. The unreviewed records cannot be counted as
verified negatives. Confirmed plus plausible is not an upper bound on phishing.

## Reproduce the source table and rates

`counts.json` gives each source row as admissions, reviewed, confirmed, and
plausible. It excludes `no_direct_feed_record`, which is outside the primary
population. Missing source rows in the earlier week are represented as zeros.
The article groups the rows as follows:

- Continuing sources: OpenPhish and URLscan.
- Newly present sources with confirmed cases: VirusTotal, PhishTank, PhishDestroy.
- Other sources: CERT Polska, Phishunt, TweetFeed, URLAbuse.

The second group supplied 650 later admissions and 39 confirmed cases. The
third supplied 306 later admissions and no reviewed confirmed cases. “Newly
present” means no admissions during the earlier comparison week. It does not
date a provider's creation or a site's deployment.

| Measure | 10th–16th October 2026 UTC | 17th–23rd October 2026 UTC |
|---|---:|---:|
| All-source admissions | 4,472 | 7,494 |
| All-source confirmed | 2 | 47 |
| Confirmed per 1,000 admissions | 0.45 | 6.27 |
| Continuing-source admissions | 4,472 | 6,538 |
| Continuing-source confirmed | 2 | 8 |
| Continuing-source confirmed plus plausible | 14 | 18 |
| Continuing-source confirmed per 1,000 | 0.45 | 1.22 |
| Continuing-source confirmed plus plausible per 1,000 | 3.13 | 2.75 |

Calculate each yield as `1,000 × case count / admissions`, then round to two
decimal places. Sum the two continuing-source rows before calculating their
rates. Averaging per-source rates would give a different measure.

## Why the observation process is not fixed

The historical collection audit inspected Git changes, stored admission times,
and deployed source on 24th October. Its findings include:

- Source searches and selection changed within the comparison. New OpenPhish
  and URLscan policy records first appeared on 13th October.
- VirusTotal first admitted a case on 19th October at 16:18:32 UTC. PhishTank
  followed at 17:16:00. PhishDestroy first admitted on 20th October at 18:57:54.
  These are first retained admissions, not exact activation times.
- Persistent queues and admission handling changed on 20th October. OpenPhish
  reached 320 admissions on each day from 20th–23rd October, after 148 on the 19th.
- Source queries and ordering changed without every policy label changing.
  Median URLscan admission delay also differed between 20th–21st and 23rd October.
- Later language, capture, and archive-review corrections changed the evidence
  available for retrospective labels, not the original admission dates.

These observations explain why matching feed names do not guarantee matching
selection. They do not measure how much of the count increase each change
caused. Subtracting cases from a newly present source cannot reconstruct the
cases other sources would have supplied.

The underlying audit record is `brazil-2026-10-24-election-observation-audit.md`,
SHA-256 `c5bed22f36aa3ae4d44d49f3be99e256d4768edd1e348445ab7f98087546ec7c`.
This public note summarizes its historical findings. It does not claim to expose
the complete operational database or independently validate the review labels.

## Calendar sensitivity and electoral context

Reassigning admissions to complete Brasília calendar weeks produces 2 confirmed
cases in 4,530 admissions, then 50 in 7,526. The JSON records these boundaries
as UTC instants for the `America/Sao_Paulo` time zone. This separate calculation
preserves the source-composition interpretation. It does not replace the
article's primary UTC table.

The [TSE warning about false electoral-debt charges](https://www.tse.jus.br/comunicacao/noticias/2026/Abril/tse-alerta-para-golpe-com-cobranca-para-regularizacao-de-pendencias-eleitorais)
documents an electoral pretext. Such examples do not supply a national phishing
denominator or establish election-caused growth. The article does not combine
voluntary notifications, monitored pages, and security-product detections into
one rate; those sources count different things.

## Screenshot source and transformation

The message image comes from TSE's warning linked above. The investigation
retained [these archived illustration bytes](https://web.archive.org/web/20261003224624id_/https://www.tse.jus.br/imagens/fotos/tse-alerta-para-golpe-com-cobranca-para-regularizacao-de-pendencias-eleitorais-07-04.2026/@@images/image-768-20fe9c2beb45d836868556cf75f05fab.jpeg)
on 24th October 2026. Their SHA-256 is
`867a9f1d7a52576ea53f36a25f0430c64c81da04e13921b2db73289dea45ed07`.
The archive URL dates that copy to 3rd October. This is not a claim that the
message or illustration first appeared on that date.

The original is 768 by 685 pixels. The published crop starts at x=14, y=244
and measures 355 by 436 pixels. It removes the sender number and surrounding
interface. Two opaque masks cover the identity fields. Relative to the crop,
their x/y/width/height values are 112/30/220/31 and 8/83/166/30. WebP encoding
uses quality 86. The output SHA-256 is
`b925cce57f22c5626a246a66d6d3596616285073e5e6c3533706f746f65ff6bd`.

The message threatens restrictions on public services, banking, and voting,
then states that a bill is available. It is an example of an electoral pretext.
It is not an additional admission or confirmed case in the article's table.

The JSON identifies the two frozen input files by SHA-256. Those digests preserve
the relationship to the closed investigation. They are not evidence that every
phishing site or every possible review candidate entered the collection.