@aglyn/shared-util-email 1.0.0-beta.219 → 1.0.0-beta.221

package/src/lib/outbound-phishing-screen.js

@@ -31,7 +31,7 @@
  *
  * A false positive costs a real merchant's first campaign a wait for a
  * human; a miss costs strangers their bank logins. Both are real, so only
- * three shapes hold, and each is one a legitimate merchant essentially never
+ * four shapes hold, and each is one a legitimate merchant essentially never
  * produces:
  *
  * 1. **A lookalike link** — a link or reply address whose host carries a
@@ -48,17 +48,27 @@
  *    neither the brand's, nor the workspace's, nor a common social or maps
  *    link. Any two of the three are ordinary marketing — "our book is on
  *    Amazon", "sign in to your account", a link to the shop — and pass.
+ * 4. **A prefilled sign-in** (AGL-3453): account or password phrasing
+ *    ("your password expires today") beside a link to such a domain that
+ *    carries the reader's own address, so the harvester's form opens with
+ *    it filled in: `…/ss/c/…#victim@example.com`.
  *
- * Mentioning a brand, alone, never holds.
+ * Mentioning a brand, alone, never holds. Brands and lures are read from
+ * what the reader SEES ({@link visibleTextOf}), never from the raw HTML, in
+ * which a kit splits every letter with a tag; links are read from the raw
+ * HTML, where an href lives.
  *
  * ## The brand list is small on purpose
  *
- * The brands phishing kits most often wear, plus the two in the incident. A
- * brand is added when it has been seen impersonated, not because it is big:
- * every entry is a set of words that can now hold somebody's newsletter.
+ * The brands phishing kits most often wear, plus the two in the incident, and
+ * the file-share and mail-security names a document-share lure wears — a
+ * "Secure Document Access Portal" under Proofpoint's or SharePoint's name
+ * whose one button leaves for the kit (AGL-3447). A brand is added when it
+ * has been seen impersonated, not because it is big: every entry is a set of
+ * words that can now hold somebody's newsletter.
  * Each carries its REAL domains, so a link to the brand itself is never
  * suspicious, and host tokens chosen so a common word (`booking`, `apple`,
- * `outlook`) does not match an unrelated host by itself.
+ * `outlook`, `box`, `adobe`) does not match an unrelated host by itself.
  *
  * Pure: no DNS, no store, no clock. Everything the caller knows about the
  * workspace arrives as input.
@@ -161,10 +171,15 @@
     {
         id: 'microsoft',
         label: 'Microsoft',
-        mention: /\bmicrosoft\b|\boffice\s?365\b|\bonedrive\b|\bsharepoint\b/i,
+        // Outlook only as the product — "our 2026 outlook" is every advisor's
+        // newsletter.
+        mention: /\bmicrosoft\b|\b(?:office|ms|m)\s?365\b|\bonedrive\b|\bsharepoint\b|\boutlook(?:\.com|\s+(?:web\s+app|web\s+access|online|account|365))\b/i,
         hostTokens: [
             'microsoft',
+            'microsoft365',
             'office365',
+            'office-365',
+            'outlook365',
             'onedrive',
             'sharepoint',
             'microsoftonline',
@@ -174,10 +189,12 @@
             'microsoft.com',
             'office.com',
             'office365.com',
+            'microsoft365.com',
             'live.com',
             'outlook.com',
             'microsoftonline.com',
             'sharepoint.com',
+            'sharepointonline.com',
             'onedrive.com',
             '1drv.ms',
             'aka.ms'
@@ -195,6 +212,158 @@
             'docusign.net'
         ]
     },
+    {
+        id: 'google',
+        label: 'Google',
+        // The account and the files, never the bare name: "find us on Google"
+        // and "Google Maps" are on every shop's contact page.
+        mention: /\bgoogle\s?(?:drive|docs?|sheets|slides|workspace|account)\b|\bgmail\b|\bg\s?suite\b/i,
+        // The products and the account, never the bare name: Google runs
+        // hyphenated hosts of its own that a page embeds, and a bare `google`
+        // token would read each as its lookalike. `docs.google.com.<kit>` is
+        // still read, by the primary-domain rule.
+        hostTokens: [
+            'gmail',
+            'gsuite',
+            'googledocs',
+            'googledrive',
+            'google-docs',
+            'google-drive',
+            'google-workspace',
+            'google-account',
+            'google-login',
+            'google-mail',
+            'docs-google',
+            'drive-google'
+        ],
+        officialDomains: [
+            'google.com',
+            'goo.gl',
+            'g.co',
+            'g.page',
+            'forms.gle',
+            'gmail.com',
+            'googleapis.com',
+            'gstatic.com',
+            'googleusercontent.com',
+            'withgoogle.com'
+        ],
+        countryDomains: true
+    },
+    {
+        id: 'adobe',
+        label: 'Adobe',
+        // "Adobe" alone is a house, a grill and an inn across the Southwest;
+        // the products are what a lure names.
+        mention: /\badobe\s?(?:acrobat|sign|id|account|document\s?cloud|reader|pdf|creative\s?cloud)\b|\bacrobat\s?(?:reader|sign|pro)\b|\bechosign\b/i,
+        hostTokens: [
+            'adobe',
+            'adobeid',
+            'adobesign',
+            'adobeacrobat',
+            'echosign'
+        ],
+        wordToken: true,
+        officialDomains: [
+            'adobe.com',
+            'adobe.io',
+            'adobe.ly',
+            'adobelogin.com',
+            'adobesign.com',
+            'echosign.com',
+            'acrobat.com',
+            'typekit.net',
+            'adobedtm.com'
+        ]
+    },
+    {
+        id: 'dropbox',
+        label: 'Dropbox',
+        // One word only: a "drop box" is by every library's door.
+        mention: /\bdropbox\b/i,
+        hostTokens: [
+            'dropbox'
+        ],
+        officialDomains: [
+            'dropbox.com',
+            'db.tt',
+            'dropboxusercontent.com',
+            'dropboxstatic.com',
+            'hellosign.com'
+        ]
+    },
+    {
+        // Never the bare word, as an id either — `brandForSubdomainLabel` reads
+        // ids as words, and "box" is every lunch box's and subscription box's.
+        id: 'boxcom',
+        label: 'Box',
+        mention: /\bbox\.com\b|\bbox\s+drive\b/i,
+        hostTokens: [
+            'boxcom',
+            'box-com'
+        ],
+        officialDomains: [
+            'box.com',
+            'box.net',
+            'boxcdn.net',
+            'boxcloud.com'
+        ]
+    },
+    {
+        id: 'wetransfer',
+        label: 'WeTransfer',
+        // One word only: "we transfer" is a moving company's sentence.
+        mention: /\bwetransfer\b/i,
+        hostTokens: [
+            'wetransfer'
+        ],
+        officialDomains: [
+            'wetransfer.com',
+            'we.tl'
+        ]
+    },
+    {
+        id: 'sharefile',
+        label: 'ShareFile',
+        mention: /\bshare\s?file\b/i,
+        hostTokens: [
+            'sharefile'
+        ],
+        officialDomains: [
+            'sharefile.com',
+            'sharefile.eu',
+            'citrix.com'
+        ]
+    },
+    {
+        // A secure-mail gateway's name is what makes a document lure read as
+        // safe: "Proofpoint Encryption for your sensitive documents".
+        id: 'proofpoint',
+        label: 'Proofpoint',
+        // One word only: a "proof point" is every pitch deck's.
+        mention: /\bproofpoint\b/i,
+        hostTokens: [
+            'proofpoint'
+        ],
+        officialDomains: [
+            'proofpoint.com',
+            'urldefense.com',
+            'pphosted.com',
+            'ppe-hosted.com'
+        ]
+    },
+    {
+        id: 'mimecast',
+        label: 'Mimecast',
+        mention: /\bmimecast\b/i,
+        hostTokens: [
+            'mimecast'
+        ],
+        officialDomains: [
+            'mimecast.com',
+            'mimecastprotect.com'
+        ]
+    },
     {
         id: 'netflix',
         label: 'Netflix',
@@ -301,26 +470,60 @@
     }
 ];
 /**
- * Account-action and credential phrasing — the half of a lure that asks the
- * reader to DO something with an account. Only ever counted beside a brand
- * AND a foreign link; alone, several of these are ordinary transactional copy.
- */ export const PHISHING_LURE_PATTERNS = [
+ * Account and credential phrasing: the lure that asks the reader to DO
+ * something with an account — verify it, confirm it, sign in to it.
+ */ export const ACCOUNT_LURE_PATTERNS = [
     /\bverify\s+your\s+(?:account|identity|information|details|payment|email)\b/i,
     /\bconfirm\s+your\s+(?:account|identity|details|payment|password|billing|information)\b/i,
-    /\b(?:account|payment|card)\s+(?:has\s+been\s+|is\s+|was\s+)?(?:suspended|locked|limited|restricted|disabled|on\s+hold)\b/i,
+    /\b(?:account|payment|card)\s+(?:has\s+been\s+|is\s+|was\s+|will\s+be\s+)?(?:suspended|locked|limited|restricted|disabled|deactivated|terminated|on\s+hold)\b/i,
     /\bunusual\s+(?:sign[-\s]?in|login|activity)\b/i,
     /\bupdate\s+your\s+(?:payment|billing|card|account)\s*(?:details|information|method)?\b/i,
     /\b(?:sign|log)\s?in\s+to\s+(?:your|view|confirm|claim|release)\b/i,
+    // "Password Expired", "your password expires today", "will expire".
+    /\bpassword\s+(?:has\s+|will\s+)?expire/i,
+    /\bkeep\s+(?:your|my|the)\s+(?:current\s+|active\s+|existing\s+|same\s+)?password\b/i,
+    /\bchange\s+(?:your\s+)?password\s+settings?\b/i,
+    /\bmailbox\s+(?:storage\s+|quota\s+)?(?:is\s+)?(?:almost\s+|nearly\s+)?(?:full|exceeded)\b/i,
+    /\bsecurity\s+alert\b/i
+];
+/**
+ * Document-share phrasing (AGL-3447): the lure that says a file is waiting
+ * behind a secure door — "Secure Document Access Portal", "Continue to
+ * Document", "shared a file with you", "encrypted message". The credential
+ * harvest is on the far side of the button, so these are the words the page
+ * or the mail itself carries.
+ */ export const DOCUMENT_SHARE_LURE_PATTERNS = [
+    /\b(?:document|invoice|agreement)s?\s+(?:is\s+|are\s+)?(?:ready|waiting|pending)\s+(?:for\s+)?(?:your\s+)?(?:review|signature|to\s+sign)\b/i,
+    /\b(?:view|access|open)\s+(?:the\s+|your\s+)?secure\s+(?:file|document|message)s?\b/i,
+    /\bsecure\s+(?:file|document|message)s?\b/i,
+    /\bdocument\s+access\b/i,
+    /\baccess\s+portal\b/i,
+    /\b(?:continue|proceed)\s+to\s+(?:the\s+|your\s+)?(?:document|file)s?\b/i,
+    /\bshared\s+(?:a|an|the)\s+(?:file|document|folder)\s+with\s+you\b/i,
+    /\b(?:file|document|folder)s?\s+(?:has\s+been|have\s+been|was|were)\s+shared\s+with\s+you\b/i,
+    /\bencrypted\s+(?:message|document|file|email)s?\b/i
+];
+/**
+ * Marketplace, booking and parcel phrasing: the lure that says a sale, a
+ * guest or a delivery needs the reader. The incident's Poshmark and
+ * Booking.com mail.
+ */ const SALE_AND_PARCEL_LURE_PATTERNS = [
     /\b(?:has|have)\s+(?:finally\s+)?sold\b/i,
     /\bseller\s+account\b/i,
     /\b(?:guest|customer)\s+(?:complaint|review|feedback)\b/i,
     /\bfeedback\s+regarding\s+your\s+(?:property|listing|stay|booking|reservation)\b/i,
-    /\b(?:document|invoice|agreement)s?\s+(?:is\s+|are\s+)?(?:ready|waiting|pending)\s+(?:for\s+)?(?:your\s+)?(?:review|signature|to\s+sign)\b/i,
-    /\bpassword\s+(?:will\s+)?expire/i,
     /\bclaim\s+your\s+(?:refund|reward|prize|package|payment|funds)\b/i,
     /\b(?:delivery|shipment)\s+(?:failed|attempt|suspended|on\s+hold)\b/i,
-    /\b(?:package|parcel)\s+(?:is\s+)?(?:on\s+hold|held|awaiting|undeliverable)\b/i,
-    /\bsecurity\s+alert\b/i
+    /\b(?:package|parcel)\s+(?:is\s+)?(?:on\s+hold|held|awaiting|undeliverable)\b/i
+];
+/**
+ * Every lure — the half of the three-part lure that asks the reader to act.
+ * Only ever counted beside a brand AND a foreign link; alone, several of
+ * these are ordinary transactional copy.
+ */ export const PHISHING_LURE_PATTERNS = [
+    ...ACCOUNT_LURE_PATTERNS,
+    ...DOCUMENT_SHARE_LURE_PATTERNS,
+    ...SALE_AND_PARCEL_LURE_PATTERNS
 ];
 /**
  * Link targets a merchant's mail ordinarily carries that are not theirs:
@@ -508,6 +711,114 @@ function isOfficialDomain(brand, registrable) {
 function safeCodePoint(value) {
     return Number.isFinite(value) && value > 0 && value <= 0x10ffff ? String.fromCodePoint(value) : '';
 }
+/** Named entities a body uses for spacing, quoting and invisible splitting. */ const NAMED_ENTITIES = {
+    nbsp: ' ',
+    ensp: ' ',
+    emsp: ' ',
+    thinsp: ' ',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    shy: '',
+    zwnj: '',
+    zwj: ''
+};
+/*
+ * Markup is read in single forward passes, never with a pattern that can
+ * rescan to the end of the body from every `<`: the screen reads every
+ * tenant message, and the tenant writes the body, so a million unclosed
+ * `<` must cost a linear read.
+ */ /** An element whose contents a reader never sees: the start of its opening tag. */ const UNSEEN_ELEMENT_OPEN = /<(style|script|head|template)\b/gi;
+/** The name at the start of a tag that breaks a line or a block: a reader sees a gap there. */ const BREAKING_TAG_NAME = /^\/?(?:br|p|div|li|ul|ol|tr|td|th|table|tbody|thead|h[1-6]|section|article|header|footer|blockquote|hr|center)\b/i;
+/** Characters that render as nothing, used to split a word for a scanner. */ const INVISIBLE_CHARACTERS = /[\u00ad\u200b-\u200d\u2060\ufeff]/g;
+/**
+ * The text between the tags, joined with NO separator — or, with `breaks`,
+ * with a space where a line or block breaks. A comment is dropped; a `<`
+ * with no `>` after it is text.
+ */ function stripMarkup(html, breaks) {
+    let text = '';
+    let at = 0;
+    while(at < html.length){
+        const open = html.indexOf('<', at);
+        if (open < 0) return text + html.slice(at);
+        text += html.slice(at, open);
+        if (html.startsWith('<!--', open)) {
+            const end = html.indexOf('-->', open + 4);
+            if (end < 0) return text;
+            at = end + 3;
+            continue;
+        }
+        const close = html.indexOf('>', open + 1);
+        if (close < 0) return text + html.slice(open);
+        if (breaks && BREAKING_TAG_NAME.test(html.slice(open + 1, Math.min(close, open + 12)))) text += ' ';
+        at = close + 1;
+    }
+    return text;
+}
+/** The markup with every unseen element and its contents taken out, in one pass. */ function dropUnseenElements(html) {
+    const lower = html.toLowerCase();
+    const open = new RegExp(UNSEEN_ELEMENT_OPEN.source, 'gi');
+    let kept = '';
+    let at = 0;
+    // Each search starts at or after the last; what it found (or that it found
+    // nothing) still answers the next one, so no stretch is scanned twice.
+    const found = new Map();
+    const find = (needle, from)=>{
+        const known = found.get(needle);
+        if (known !== undefined && (known < 0 || known >= from)) return known;
+        const position = lower.indexOf(needle, from);
+        found.set(needle, position);
+        return position;
+    };
+    for(let match = open.exec(html); match; match = open.exec(html)){
+        // No `>` after it: neither this nor anything later is a tag.
+        const tagEnd = find('>', open.lastIndex);
+        if (tagEnd < 0) break;
+        kept += `${html.slice(at, match.index)} `;
+        const name = match[1].toLowerCase();
+        const close = find(`</${name}`, tagEnd + 1);
+        // A head nobody closed ends where the body starts, as a browser reads it.
+        const body = name === 'head' ? find('<body', tagEnd + 1) : -1;
+        if (body >= 0 && (close < 0 || body < close)) {
+            at = body;
+        } else {
+            const end = close < 0 ? -1 : find('>', close);
+            // Never closed: only the opening tag goes, and what follows is still
+            // read, so an unclosed `<style>` cannot hide the lure after it.
+            at = end < 0 ? tagEnd + 1 : end + 1;
+        }
+        open.lastIndex = at;
+    }
+    return kept + html.slice(at);
+}
+/**
+ * What a reader SEES in a body (AGL-3453): its text with the markup taken
+ * out, the way a mail client or a browser draws it.
+ *
+ * A kit splits every letter of a brand and a lure with a tag —
+ * `G<SPAN class=…>o<SPAN …>o…gle`, `P<SPAN …>a<SPAN …>s…word E<SPAN …>x…pired`
+ * — so the raw HTML never contains the word a reader reads. Tags are
+ * therefore removed with NO separator, which rejoins the letters; `<style>`,
+ * `<script>` and `<head>` are dropped with their contents; comments and
+ * zero-width characters are dropped; entities are decoded; whitespace is
+ * collapsed. A second reading that puts a space where a line or block
+ * breaks is added when it differs, so two words in two paragraphs are still
+ * two words. Links are NOT read from this: an href lives inside a tag.
+ */ export function visibleTextOf(html) {
+    const text = String(html != null ? html : '');
+    const source = text.includes('<') ? dropUnseenElements(text) : text;
+    const read = (breaks)=>decodeVisibleEntities(stripMarkup(source, breaks)).replace(INVISIBLE_CHARACTERS, '').replace(/\s+/g, ' ').trim();
+    const joined = read(false);
+    const broken = read(true);
+    return broken === joined ? joined : `${joined}\n${broken}`;
+}
+/** {@link decodeEntities}, after the named entities a body reads with. */ function decodeVisibleEntities(text) {
+    return decodeEntities(text.replace(/&([a-z]{2,8});/gi, (entity, name)=>{
+        var _NAMED_ENTITIES_name_toLowerCase;
+        return (_NAMED_ENTITIES_name_toLowerCase = NAMED_ENTITIES[name.toLowerCase()]) != null ? _NAMED_ENTITIES_name_toLowerCase : entity;
+    }));
+}
 const URL_PATTERN = /\b(?:https?:\/\/|www\.)[^\s"'<>()\\[\]{}]+/gi;
 /** The hosts every link in the text points at, lowercased. */ export function linkHostsIn(text) {
     var _decodeEntities_match;
@@ -535,6 +846,71 @@ const URL_PATTERN = /\b(?:https?:\/\/|www\.)[^\s"'<>()\\[\]{}]+/gi;
         ...hosts
     ];
 }
+/** Every link in the text, with what it carries after its path. */ function linkTargetsIn(text) {
+    var _decodeEntities_match;
+    const targets = [];
+    for (const match of (_decodeEntities_match = decodeEntities(String(text != null ? text : '')).match(URL_PATTERN)) != null ? _decodeEntities_match : []){
+        // The first host is where the browser goes; a userinfo disguise is not.
+        const [host] = linkHostsIn(match);
+        if (!host) continue;
+        const hash = match.indexOf('#');
+        const beforeHash = hash < 0 ? match : match.slice(0, hash);
+        const question = beforeHash.indexOf('?');
+        targets.push({
+            host,
+            query: question < 0 ? '' : decodeUrlPart(beforeHash.slice(question + 1)),
+            fragment: hash < 0 ? '' : decodeUrlPart(match.slice(hash + 1))
+        });
+    }
+    return targets;
+}
+function decodeUrlPart(part) {
+    try {
+        return decodeURIComponent(part);
+    } catch (unused) {
+        return part;
+    }
+}
+const EMAIL_ADDRESS = /^[a-z0-9._%+-]+@[a-z0-9-]+(?:\.[a-z0-9-]+)+$/i;
+const EMAIL_ADDRESS_IN_TEXT = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
+const BASE64_TEXT = /^[a-z0-9+/_-]{8,}={0,2}$/i;
+/** A fragment read as base64, the other way a kit carries the address, or ''. */ function base64Text(fragment) {
+    const decode = globalThis.atob;
+    if (!decode || !BASE64_TEXT.test(fragment)) return '';
+    try {
+        return decode(fragment.replace(/-/g, '+').replace(/_/g, '/'));
+    } catch (unused) {
+        return '';
+    }
+}
+/**
+ * Where a link carries a reader's own address (AGL-3453), or null.
+ *
+ * - `fragment`: the WHOLE fragment is an address, plain or base64 —
+ *   `…#victim@example.com`. A fragment never reaches the server; the only
+ *   thing that reads it is the landing page's script, filling a sign-in
+ *   form so the reader sees their own address and types the password.
+ * - `parameter`: an address that is not the workspace's own inside a query
+ *   or a longer fragment — `?email=victim@example.com`, a hash route's
+ *   `#/login?email=…`. Ordinary in a sign-up or a SaaS login link, so softer.
+ */ function prefilledAddressIn(target, isOwnHost) {
+    const fragment = target.fragment.trim();
+    if (fragment && (EMAIL_ADDRESS.test(fragment) || EMAIL_ADDRESS.test(base64Text(fragment).trim()))) {
+        return 'fragment';
+    }
+    for (const part of [
+        target.query,
+        target.fragment
+    ]){
+        // An address is short; a tracking token can be kilobytes of the
+        // characters an address is made of, so only the head of one is read.
+        if (!part.includes('@')) continue;
+        for (const match of part.slice(0, 4096).matchAll(EMAIL_ADDRESS_IN_TEXT)){
+            if (!isOwnHost(match[1].toLowerCase())) return 'parameter';
+        }
+    }
+    return null;
+}
 const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
 /** The host of every email address in the text — a reply-to, a `mailto:`. */ function addressHostsIn(text) {
     const hosts = new Set();
@@ -579,12 +955,15 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
     const ownHosts = ((_input_ownDomains = input.ownDomains) != null ? _input_ownDomains : []).map((domain)=>String(domain != null ? domain : '').trim().toLowerCase().replace(/\.+$/, '')).filter((domain)=>domain.includes('.'));
     const ownRegistrables = new Set(ownHosts.map(registrableDomain));
     const isOwnHost = (host)=>ownHosts.some((own)=>host === own || host.endsWith(`.${own}`));
-    const copy = [
+    const parts = [
         input.subject,
         input.preheader,
         ...(_input_bodies = input.bodies) != null ? _input_bodies : []
-    ].filter((part)=>typeof part === 'string' && part.length > 0).join('\n');
-    const decodedCopy = decodeEntities(copy);
+    ].filter((part)=>typeof part === 'string' && part.length > 0);
+    // Links are read from the raw copy, where an href lives; brands and lures
+    // from what a reader sees, where a tag cannot split a word (AGL-3453).
+    const copy = parts.join('\n');
+    const visibleCopy = parts.map(visibleTextOf).join('\n');
     const replyTo = Array.isArray(input.replyTo) ? input.replyTo.join(' ') : String((_input_replyTo = input.replyTo) != null ? _input_replyTo : '');
     const linkHosts = linkHostsIn(copy);
     // 1. A lookalike host, anywhere a recipient could click, write back, or
@@ -620,18 +999,19 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
         }
     }
     // 3. Brand + lure + a link to somewhere that is nobody's we know.
+    const isElsewhere = (host)=>{
+        if (isOwnHost(host)) return false;
+        const registrable = registrableDomain(host);
+        return !isAnyOfficialDomain(registrable) && !COMMON_LINK_DOMAINS.has(registrable);
+    };
     const lure = PHISHING_LURE_PATTERNS.map((pattern)=>{
-        var _decodedCopy_match;
-        return (_decodedCopy_match = decodedCopy.match(pattern)) == null ? void 0 : _decodedCopy_match[0];
+        var _visibleCopy_match;
+        return (_visibleCopy_match = visibleCopy.match(pattern)) == null ? void 0 : _visibleCopy_match[0];
     }).find(Boolean);
     if (lure) {
-        const foreign = linkHosts.find((host)=>{
-            if (isOwnHost(host)) return false;
-            const registrable = registrableDomain(host);
-            return !isAnyOfficialDomain(registrable) && !COMMON_LINK_DOMAINS.has(registrable);
-        });
+        const foreign = linkHosts.find(isElsewhere);
         if (foreign) {
-            const namedInCopy = `${decodedCopy}\n${fromName}`;
+            const namedInCopy = `${visibleCopy}\n${fromName}`;
             for (const brand of PHISHING_SCREEN_BRANDS){
                 if (brand.mention.test(namedInCopy) && !isOwnBrand(brand, ownNames, ownRegistrables)) {
                     signals.push({
@@ -645,6 +1025,33 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
             }
         }
     }
+    // 4. An account lure beside a link elsewhere that carries the reader's own
+    //    address, filled in for the sign-in form at the far end (AGL-3453).
+    const accountLure = ACCOUNT_LURE_PATTERNS.map((pattern)=>{
+        var _visibleCopy_match;
+        return (_visibleCopy_match = visibleCopy.match(pattern)) == null ? void 0 : _visibleCopy_match[0];
+    }).find(Boolean);
+    if (accountLure) {
+        let prefill = null;
+        for (const target of linkTargetsIn(copy)){
+            if (!isElsewhere(target.host)) continue;
+            const place = prefilledAddressIn(target, isOwnHost);
+            if (place && (!prefill || place === 'fragment' && prefill.place !== 'fragment')) {
+                prefill = {
+                    host: target.host,
+                    place
+                };
+            }
+        }
+        if (prefill) {
+            signals.push({
+                code: 'recipient-prefill-link',
+                host: prefill.host,
+                lure: accountLure.slice(0, 120),
+                place: prefill.place
+            });
+        }
+    }
     return {
         hold: signals.length > 0,
         signals
@@ -655,6 +1062,21 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
     var _PHISHING_SCREEN_BRANDS_find;
     return (_ref = (_PHISHING_SCREEN_BRANDS_find = PHISHING_SCREEN_BRANDS.find((brand)=>brand.id === id)) == null ? void 0 : _PHISHING_SCREEN_BRANDS_find.label) != null ? _ref : id;
 }
+/** Web Risk's threat types, in the words staff read (AGL-3451). */ const LINK_THREAT_WORDS = {
+    SOCIAL_ENGINEERING: 'phishing or social engineering',
+    MALWARE: 'malware',
+    UNWANTED_SOFTWARE: 'unwanted software'
+};
+/** "phishing or social engineering and malware", from Web Risk's threat types. */ export function describeLinkThreats(threats) {
+    const words = [
+        ...new Set(threats)
+    ].map((threat)=>{
+        var _LINK_THREAT_WORDS_threat;
+        return (_LINK_THREAT_WORDS_threat = LINK_THREAT_WORDS[threat]) != null ? _LINK_THREAT_WORDS_threat : threat.toLowerCase();
+    });
+    if (!words.length) return 'unsafe';
+    return words.length === 1 ? words[0] : `${words.slice(0, -1).join(', ')} and ${words[words.length - 1]}`;
+}
 /** One line per signal, in words staff read on the review row. */ export function describePhishingScreenSignals(signals) {
     return signals.map((signal)=>{
         const brand = 'brand' in signal ? phishingScreenBrandLabel(signal.brand) : '';
@@ -669,6 +1091,16 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
                 return `Asks for a ${signal.field === 'card' ? 'card number' : signal.field === 'otp' ? 'one-time code' : 'password'} in its own field ("${signal.label}"), outside the platform's sign-in and checkout elements.`;
             case 'brand-action-page':
                 return `Names ${brand} beside a call to action ("${signal.action}"), and this workspace is not ${brand}.`;
+            case 'brand-lure-page':
+                return `Names ${brand} on a page that asks visitors to act ("${signal.lure}") and links to ${signal.host}, and this workspace is not ${brand}.`;
+            case 'offsite-action-page':
+                return `Its call to action ("${signal.action}") sends visitors off the site to ${signal.host}, on a page that reads "${signal.lure}".`;
+            case 'offsite-redirect':
+                return `Redirects ${signal.source}, a path that reads "${signal.lure}", off the site to ${signal.host}.`;
+            case 'recipient-prefill-link':
+                return `Links to ${signal.host} with the recipient's own address in the ${signal.place === 'fragment' ? 'fragment' : 'link'}, so a sign-in form there opens filled in, beside "${signal.lure}".`;
+            case 'web-risk-link':
+                return `Links to ${signal.host}, which Google Web Risk lists as ${describeLinkThreats(signal.threats)}.`;
             default:
                 return 'Phishing signal.';
         }
@@ -686,20 +1118,34 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
  *   workspace is, so it holds for EVERY workspace, on every message and
  *   page, transactional mail included. A merchant has no ordinary reason to
  *   link to a host shaped like somebody else's brand.
+ * - STRONG, too: account or password phrasing beside a link elsewhere whose
+ *   whole FRAGMENT is the reader's address (AGL-3453). A fragment never
+ *   reaches a server, so the address there is for the landing page's script
+ *   to fill a sign-in form with; a merchant's own reset mail links to its
+ *   own domain, and a SaaS login link puts the address in its query, which
+ *   is soft.
  * - SOFT: a brand in the sender name, the three-part lure, a brand's name
- *   beside a sign-in or payment call to action on a page. Each is shaped
- *   like phishing but also like a clumsy legitimate message, so they hold
+ *   beside a sign-in or payment call to action on a page (in one element,
+ *   or anywhere on a page that carries a lure), a call to action or a
+ *   redirect that leaves the site beside account or document-share wording,
+ *   the reader's address in a query beside account phrasing.
+ *   Each is shaped like phishing but also like a clumsy legitimate message,
+ *   so they hold
  *   only for a workspace in its first {@link OUTBOUND_REVIEW_YOUNG_DAYS}
  *   days — the incident's window — and NEVER for mail the recipient's own
  *   act made owed ({@link OutboundScreenPolicy.owed}).
  *
  * A credential-harvest page (a password, card or one-time-code field that
  * is not one of the platform's own sign-in or checkout elements) is STRONG:
- * see `hosted-page-screen.ts`.
+ * see `hosted-page-screen.ts`. So is a link to a host Google Web Risk lists
+ * (`web-risk-link`, `link-reputation.ts`): it holds for every workspace, and
+ * an account-subdomain host does not soften it, because the listing names
+ * that host itself.
  *=========================================*/ /** A workspace younger than this many days has the soft rules applied. */ export const OUTBOUND_REVIEW_YOUNG_DAYS = 14;
 /** The signal codes that hold for every workspace. */ export const STRONG_PHISHING_SIGNAL_CODES = new Set([
     'lookalike-link',
-    'credential-field'
+    'credential-field',
+    'web-risk-link'
 ]);
 /**
  * Hosts that give each customer an account subdomain named after the
@@ -735,6 +1181,9 @@ const ADDRESS_HOST_PATTERN = /[a-z0-9._%+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/gi;
     'mailchimpsites.com'
 ]);
 export function phishingSignalTier(signal) {
+    if ((signal == null ? void 0 : signal.code) === 'recipient-prefill-link') {
+        return signal.place === 'fragment' ? 'strong' : 'soft';
+    }
     if (!STRONG_PHISHING_SIGNAL_CODES.has(signal == null ? void 0 : signal.code)) return 'soft';
     if (signal.code === 'lookalike-link' && typeof signal.host === 'string' && ACCOUNT_SUBDOMAIN_HOSTS.has(registrableDomain(signal.host))) {
         return 'soft';