The country your threat feed forgot

Every URL reputation system I have worked with leans, directly or indirectly, on domain popularity. Tranco, Majestic, Cisco Umbrella — the reasoning is sound: a domain in the global top 100,000 with years of history is unlikely to be a phishing page spun up yesterday.

Then you point it at Armenia and it tells your users that their bank is suspicious.

Why popularity fails outside the anglophone web

A national bank serving three million people generates a rounding error of global traffic. So does the state tax portal, the electricity utility, the largest local news site, and the government services gateway.

These domains have every property a reputation system claims to want — a decade of registration history, valid certificates, stable infrastructure, institutional ownership. They just do not have volume, because there are not enough people in the country to produce it.

Meanwhile the phishing page impersonating that bank is often hosted on a subdomain of a service that is globally popular, inheriting reputation it did not earn.

The signal is not merely weak in small markets. It is occasionally inverted.

The real cost is not the false positive

A security product that flags your bank is annoying. A security product that flags your bank and your tax portal and your utility company teaches you that its warnings are noise.

That is the actual damage. Every unnecessary warning spends a small amount of the user's willingness to believe the next one, and you cannot get it back. By the time a genuine credential-harvesting page appears, the user has been trained by your own product to click through.

Alert fatigue is not a UX problem. It is a security failure with a UX-shaped cause.

What to do about it

The fix is conceptually dull: stop treating global popularity as evidence of legitimacy, and give the system a jurisdiction-aware notion of which institutions actually matter locally — sourced from authoritative local records rather than inferred from traffic.

The important part is what that changes. A low global ranking stops being evidence of badness; it goes back to being what it always was, an absence of information. The other signals in the pipeline then decide, on their own merits, instead of starting from a thumb on the scale.

I am deliberately not publishing the structure I use, how it is weighted, or how it interacts with the rest of the detection pipeline. Anything specific enough to be useful to another engineer here is also specific enough to be useful to someone building a page designed to score well against it. If you are working on this problem seriously, get in touch and we can talk properly.

The unglamorous part

There is no clever algorithm in any of this. Someone has to assemble the data for each jurisdiction, verify it against official sources, and maintain it as institutions merge and rebrand.

It does not generalise automatically, it does not scale to two hundred countries without two hundred units of work, and it demos terribly.

It is also the difference between a product that works where I live and one that does not. Most security tooling is built by people in markets where the global signal happens to be adequate, and the failure mode is invisible from there — you have to be in the small market to notice that the tool is quietly wrong about everything that matters.

The general lesson

If your detection logic depends on a popularity, volume, or "we have seen this before" signal, go and find the population for whom that signal is structurally unavailable. They exist. They are not an edge case to be handled later — they are the group your product is actively worst for, and they will churn without ever filing a bug report explaining why.