Skip to main content

Phish-Guard

Source: shared/api-core/src/lib/phishGuard.ts.

Phishing detection is not a parallel operator family. URL and certificate features are mapped into the existing HF1–HF20 forensic spectrum — the same operators the anti-hallucination forensics use for claim verification — and the composite is produced by compositeForensic(...). Phish detection lives inside the framework's own semantics as a feature mapping on top of HF.

PhishScore(url) = Σ_{k=1..F} w_k · feature_k(url)      (normalised [0,1])

The wrapper operator surfaced on audit rows is PHISH-001 (registered in the operator registry). Its equation is the weighted sum-of-features form that produces the per-feature input vector; the HF composite then carries the KO42 modulation through to S_forensic.

API​

  • classifyUrl(url) → PhishClassification — feature extraction + HF composite.
  • classifyDomain(domain, certChain?) — domain/cert-aware variant.
  • Feature tables ship in the module: CANONICAL_BRANDS, SUSPICIOUS_TLDS, URL_SHORTENERS, CRED_FORM_KEYWORDS.

Who consumes it​

  • the phishing HTTP surface (classify / report / check / verify / feed);
  • Zeq-AV — a local URL classifier for browser/file scans;
  • the Zeq-VPN datapath — DNS/HTTP request-time pre-block.

The Phish-Guard HTTP surface (classify / report / check / verify / feed) is live — the routes are mounted and verified (/api/phish/feed → 200). The same library also backs the Zeq-AV scanner and the Zeq-VPN request-time datapath.