Inclusion means someone contributed a message
Anyone can submit without an account. A descriptive report explains what the message says and requests. Inclusion does not establish whether a message is suspicious, authentic, safe, or malicious. The library does not determine whether someone was targeted.
Examples and template groups
Repeated copies can share one published example. Closely matching examples can join a template group automatically. Grouping compares the retained message wording, available structure, and content categories; it does not compare the prose of the generated reports.
Approximate grouping requires extensive wording overlap and compatible features, followed by an automated pair comparison. Uncertain matches remain separate. Short messages can be reused as exact examples but are not automatically joined by approximate wording alone. Similarity does not establish a common sender, campaign, or origin.
Reading the reporting charts
Charts show a relative index for complete UTC calendar weeks. Each week is compared with the average reporting activity of the preceding four complete weeks. An index of 100 means the same activity as that average; 200 means twice that relative activity. Values are rounded to the nearest 10.
We remove repeated contributions from the same limited browser signal. Anonymous submissions cannot establish unique people or recipients. Charts are withheld when there is too little history or supporting data, or a known processing gap. Missing values are not zero. Raw reporting totals are not published.
This is a view of reports received by Phaquarium, not an estimate of total messages, attacks, or victims. Different groups have different baselines, so their indexes cannot compare absolute volumes. Grouping changes and withdrawals can change historical charts.
What happens to your message
Local parsing removes active content and obvious identifiers such as addresses, telephone numbers, and link destinations. Remaining message text is sent to DeepSeek V4.1 Flash for contextual de-identification, a descriptive summary, and automatic validation. Local filtering does not guarantee that all personal information is removed before DeepSeek receives the text.
Temporary processing text is encrypted in storage and expires within 24 hours. Initial text is replaced after contextual redaction. Expired text is unavailable for processing and deleted automatically; deletion resumes when the service returns after any downtime. Built-in backups exclude temporary processing text. Infrastructure backups may retain encrypted copies until their retention periods end. Validated private results expire after seven days. If you choose public contribution at upload, results that pass automated checks publish without another approval step. Public examples remain until withdrawn or removed by automatic checks.
These are OutPhish retention periods; DeepSeek processes API inputs under its applicable service terms. De-identification and automated checks can make mistakes. Content that fails checks is repaired within limits or withheld. No original attachment is opened, original destination visited, or submitted HTML executed.
Returning or withdrawing
Save the private link shown after submission. It provides access to your result and a self-service withdrawal action. Keep it private. Removing your contribution also removes its reporting activity. An example can remain when another contribution independently supports it.
Automatic checks and corrections
Processing, publication, grouping, reports, and charts run automatically. Content-issue reports schedule an automatic recheck. Detected problems can cause content to be withheld or a group to be split. Reports remain descriptive throughout.