scamgate 0.3.3__py3-none-any.whl

scamgate/__init__.py

@@ -0,0 +1,11 @@
+"""scamgate: a self-hosted scam check for AI agents."""
+
+__version__ = "0.3.3"
+
+
+def register(ctx):
+    """Hermes plugin entry. Imported lazily so a normal install never loads the plugin."""
+    from .plugin import register as _register
+
+    return _register(ctx)
+

scamgate/asklog.py

@@ -0,0 +1,153 @@
+"""Ask log: every gated call scamgate escalated or blocked, plus what happened next.
+
+Two append-only JSONL files in the state dir:
+- asks.jsonl: one entry per flagged call (redacted targets, rules, score, agent's stated reason)
+- outcomes.jsonl: whether the call then ran (human approved) or didn't (human refused / blocked)
+
+The agent's stated reason is stored for a human to read. It is marked untrusted and is never used
+to change rules automatically: injected page text can write it.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import time
+from collections import defaultdict
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+from .redact import redact_text, redact_url
+from .state import ensure_state_dir, state_dir
+
+
+def log_path() -> Path:
+    return state_dir() / "asks.jsonl"
+
+
+def outcomes_path() -> Path:
+    return state_dir() / "outcomes.jsonl"
+
+
+def _pending_path(key: str) -> Path:
+    return state_dir() / "pending" / key
+
+
+def _append(path: Path, rec: dict) -> None:
+    from .guard import append_private  # only you can read which sites were asked about
+
+    append_private(path, json.dumps(rec, ensure_ascii=False))
+
+
+def make_key(session: str, call_id: str) -> str:
+    return hashlib.sha256(f"{session}\0{call_id}".encode()).hexdigest()[:16]
+
+
+def log_check(*, tool: str, decision: str, risk_score: int, rule_ids: list[str], targets: list[str],
+              hosts: list[str], stated_reason: str | None, session: str, call_id: str,
+              agent: str = "hermes") -> str:
+    key = make_key(session, call_id or f"{time.time_ns()}")
+    _append(log_path(), {
+        "ts": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        "key": key,
+        "agent": agent,
+        "tool": tool,
+        "decision": decision,
+        "risk_score": risk_score,
+        "rules": sorted(set(rule_ids)),
+        "hosts": sorted(set(hosts)),
+        "targets": [redact_url(t) for t in targets[:5]],
+        "stated_reason": redact_text(stated_reason or "", limit=80),
+        "stated_reason_trust": "untrusted",
+    })
+    if decision in ("approve", "ask"):
+        p = _pending_path(key)
+        ensure_state_dir()
+        p.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        os.close(os.open(p, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600))
+    return key
+
+
+def record_outcome(key: str, outcome: str) -> bool:
+    """outcome: 'ran' (human approved) or 'not_run' (refused, timed out, or blocked)."""
+    p = _pending_path(key)
+    if not p.exists():
+        return False
+    _append(outcomes_path(), {"ts": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+                              "key": key, "outcome": outcome})
+    p.unlink(missing_ok=True)
+    return True
+
+
+def _read(path: Path) -> list[dict]:
+    if not path.exists():
+        return []
+    out = []
+    for line in path.read_text("utf-8").splitlines():
+        try:
+            out.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue
+    return out
+
+
+def read_entries() -> list[dict]:
+    return _read(log_path())
+
+
+def read_outcomes() -> dict[str, str]:
+    return {o["key"]: o["outcome"] for o in _read(outcomes_path()) if "key" in o}
+
+
+@dataclass
+class ReviewRow:
+    host: str
+    asks: int = 0
+    blocks: int = 0
+    ran: int = 0
+    not_run: int = 0
+    pending: int = 0
+    rules: dict[str, int] = field(default_factory=dict)
+    tools: dict[str, int] = field(default_factory=dict)
+    sample_reasons: list[str] = field(default_factory=list)
+
+
+def summarize(days: int = 7, now: datetime | None = None) -> list[ReviewRow]:
+    now = now or datetime.now(timezone.utc)
+    cutoff = now - timedelta(days=days)
+    outcomes = read_outcomes()
+    rows: dict[str, ReviewRow] = {}
+    rule_counts: dict[str, dict[str, int]] = defaultdict(lambda: defaultdict(int))
+    tool_counts: dict[str, dict[str, int]] = defaultdict(lambda: defaultdict(int))
+    for e in read_entries():
+        try:
+            ts = datetime.fromisoformat(e["ts"])
+        except (KeyError, ValueError):
+            continue
+        if ts < cutoff:
+            continue
+        for host in e.get("hosts") or ["<no host>"]:
+            row = rows.setdefault(host, ReviewRow(host))
+            if e.get("decision") == "block":
+                row.blocks += 1
+            else:
+                row.asks += 1
+                o = outcomes.get(e.get("key", ""))
+                if o == "ran":
+                    row.ran += 1
+                elif o == "not_run":
+                    row.not_run += 1
+                else:
+                    row.pending += 1
+            for r in e.get("rules", []):
+                rule_counts[host][r] += 1
+            tool_counts[host][e.get("tool", "?")] += 1
+            reason = e.get("stated_reason")
+            if reason and reason not in row.sample_reasons and len(row.sample_reasons) < 3:
+                row.sample_reasons.append(reason)
+    for host, row in rows.items():
+        row.rules = dict(sorted(rule_counts[host].items(), key=lambda kv: -kv[1]))
+        row.tools = dict(sorted(tool_counts[host].items(), key=lambda kv: -kv[1]))
+    return sorted(rows.values(), key=lambda r: (-(r.asks + r.blocks), r.host))

scamgate/bench.py

@@ -0,0 +1,77 @@
+"""Run YAML scenarios through the engine and score the results."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from . import engine
+from .models import Decision, PaymentCheck, Verdict
+
+
+@dataclass
+class Result:
+    scenario_id: str
+    name: str
+    label: str  # scam | legit
+    expected: Decision
+    verdict: Verdict
+
+    @property
+    def flagged(self) -> bool:
+        return self.verdict.decision is not Decision.allow
+
+    @property
+    def outcome(self) -> str:
+        if self.label == "scam":
+            return "caught" if self.flagged else "missed"
+        # A legit case may still be *expected* to ask (e.g. over budget); that is not a false positive.
+        if self.flagged and self.expected is Decision.allow:
+            return "false_positive"
+        return "ok"
+
+    @property
+    def exact(self) -> bool:
+        return self.verdict.decision is self.expected
+
+
+def load_scenarios(directory: Path) -> list[dict]:
+    out = []
+    for f in sorted(directory.glob("*.yaml")):
+        data = yaml.safe_load(f.read_text("utf-8"))
+        data.setdefault("id", f.stem)
+        out.append(data)
+    return out
+
+
+def run_scenario(s: dict) -> Result:
+    kind = s["kind"]
+    inp = s["input"]
+    if kind == "url":
+        verdict = engine.check_url(inp["url"], inp.get("intent"))
+    elif kind == "payment":
+        verdict = engine.check_payment(PaymentCheck(**inp), use_history=False)  # scenario input is ground truth
+    else:
+        raise ValueError(f"{s['id']}: unknown kind {kind!r}")
+    label = s["label"]
+    if label not in ("scam", "legit"):
+        raise ValueError(f"{s['id']}: label must be scam or legit")
+    return Result(s["id"], s.get("name", s["id"]), label, Decision(s["expected"]), verdict)
+
+
+def run_all(directory: Path) -> list[Result]:
+    return [run_scenario(s) for s in load_scenarios(directory)]
+
+
+def summarize(results: list[Result]) -> dict[str, int]:
+    return {
+        "total": len(results),
+        "scams": sum(r.label == "scam" for r in results),
+        "legit": sum(r.label == "legit" for r in results),
+        "caught": sum(r.outcome == "caught" for r in results),
+        "missed": sum(r.outcome == "missed" for r in results),
+        "false_positives": sum(r.outcome == "false_positive" for r in results),
+        "exact_decision_match": sum(r.exact for r in results),
+    }

scamgate/cli.py

@@ -0,0 +1,209 @@
+"""scamgate command line."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Optional
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from . import bench as bench_mod
+from . import engine
+
+app = typer.Typer(help="Self-hosted scam check for AI agents.", no_args_is_help=True)
+console = Console()
+
+
+@app.command()
+def serve() -> None:
+    """Run the MCP server over stdio."""
+    from .server import run
+
+    run()
+
+
+@app.command("check-url")
+def check_url_cmd(url: str, intent: Optional[str] = typer.Option(None, help="What the agent is trying to do")) -> None:
+    """Check one URL and print the verdict as JSON."""
+    console.print_json(json.dumps(engine.check_url(url, intent).model_dump(mode="json")))
+
+
+@app.command("update-feeds")
+def update_feeds_cmd(
+    feed: list[str] = typer.Option(None, "--feed", "-f", help="Feed(s) to fetch; default: all default feeds"),
+    all_feeds: bool = typer.Option(False, "--all", help="Also fetch opt-in feeds (large Phishing.Database links list)"),
+    cache: Optional[Path] = typer.Option(None, "--cache-dir", help="Cache folder (default $SCAMGATE_CACHE_DIR or ~/.cache/scamgate)"),
+) -> None:
+    """Download known-bad-link feeds into the local cache. Failed feeds keep their old cache."""
+    from . import feeds as feeds_mod
+
+    names = list(feed) if feed else ([*feeds_mod.FEEDS] if all_feeds else None)
+    results = feeds_mod.update_feeds(names, directory=cache)
+    table = Table(title=f"feeds -> {cache or feeds_mod.cache_dir()}")
+    for col in ("feed", "status", "urls", "hosts", "note"):
+        table.add_column(col)
+    for r in results:
+        table.add_row(r.name, "[green]ok[/green]" if r.ok else "[yellow]not updated[/yellow]",
+                      str(r.urls) if r.ok else "", str(r.hosts) if r.ok else "", r.message)
+    console.print(table)
+    if not any(r.ok for r in results):
+        raise typer.Exit(1)
+
+
+@app.command("domain-age")
+def domain_age_cmd(host: str = typer.Argument(..., help="Domain or URL, e.g. shop.example")) -> None:
+    """Look up when a domain was registered (RDAP) and cache it. This goes online, to the domain's registry."""
+    from . import domainage
+    from .rules.url import parse
+
+    dom = parse(host).registrable
+    age = domainage.lookup(dom, live=True)
+    if age is None:
+        console.print(f"{dom}: registration date not available (the registry didn't say, or isn't on RDAP).")
+        raise typer.Exit(1)
+    console.print(f"{dom}: registered {age} days ago. Cached for SCAMGATE_RDAP=cache|live.")
+
+
+@app.command("feeds-status")
+def feeds_status(cache: Optional[Path] = typer.Option(None, "--cache-dir")) -> None:
+    """Show cached feeds, their entry counts and age."""
+    from . import feeds as feeds_mod
+
+    meta = feeds_mod.read_meta(cache)
+    if not meta:
+        console.print("No feeds cached yet. Run `scamgate update-feeds`.")
+        raise typer.Exit(1)
+    idx = feeds_mod.FeedIndex(fetched_at={k: v.get("fetched_at", "") for k, v in meta.items()})
+    stale = set(idx.stale_feeds())
+    for name, m in meta.items():
+        flag = " [yellow](stale)[/yellow]" if name in stale else ""
+        console.print(f"{name}: {m.get('urls', 0)} urls, {m.get('hosts', 0)} hosts, fetched {m.get('fetched_at')}{flag}")
+
+
+@app.command()
+def hook() -> None:
+    """Enforcement hook: read a Hermes or Claude Code hook event (JSON) on stdin, print the decision."""
+    from . import hook as hook_mod
+
+    raise typer.Exit(hook_mod.main())
+
+
+@app.command()
+def review(days: int = typer.Option(7, help="Look back this many days"),
+           limit: int = typer.Option(15, help="Show at most this many hosts")) -> None:
+    """Show which links keep tripping the gate, and what you did with each ask."""
+    from . import asklog
+
+    rows = asklog.summarize(days=days)[:limit]
+    if not rows:
+        console.print(f"No asks or blocks in the last {days} days.")
+        return
+    table = Table(title=f"scamgate asks, last {days} days")
+    for col in ("host", "asks", "you approved", "you refused", "pending", "blocked", "top rules", "tools"):
+        table.add_column(col)
+    for r in rows:
+        table.add_row(r.host, str(r.asks), str(r.ran), str(r.not_run), str(r.pending), str(r.blocks),
+                      ", ".join(list(r.rules)[:2]), ", ".join(list(r.tools)[:2]))
+    console.print(table)
+    for r in rows[:5]:
+        if r.sample_reasons:
+            console.print(f"[dim]{r.host}: agent said (untrusted): "
+                          + " | ".join(f"\"{s}\"" for s in r.sample_reasons) + "[/dim]")
+    console.print("\nTurn a repeat ask into a rule: [bold]scamgate promote --host HOST --decision deny[/bold], or "
+                  "[bold]--decision allow --rule RULE_ID[/bold] (allow waives one rule on one exact host).")
+
+
+@app.command()
+def promote(host: str = typer.Option(..., help="Exact host, e.g. shop.example (no wildcards)"),
+            decision: str = typer.Option(..., help="allow or deny"),
+            rule: Optional[str] = typer.Option(None, help="For allow: the one rule to waive on this host"),
+            note: str = typer.Option("", help="Why (for your own records)")) -> None:
+    """Add a human-approved override. Asks for confirmation; agents are blocked from running this."""
+    from . import overrides
+
+    from . import guard
+
+    try:
+        guard.require_human("Adding a scamgate override", interactive=lambda: overrides._interactive())
+    except PermissionError as exc:
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(3)
+    if decision == "allow" and not rule:
+        console.print("An allow rule must name the one rule it waives: add --rule RULE_ID "
+                      "(see `scamgate review` for the rules that fired).")
+        raise typer.Exit(2)
+    if rule and rule in overrides.NEVER_WAIVED:
+        console.print(f"{rule} can't be waived: known-bad feeds, your blocklist and seed-phrase checks always apply.")
+        raise typer.Exit(2)
+    scope = (f"waive '{rule}' for {host} only (not its subdomains)" if decision == "allow"
+             else f"deny {host} and all its subdomains")
+    console.print(f"This will {scope}.")
+    if not typer.confirm("Add this rule?", default=False):
+        raise typer.Exit(1)
+    try:
+        rec = overrides.add(host, decision, rule=rule, note=note)
+    except ValueError as exc:
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(2)
+    console.print(f"Added: {rec['decision']} {rec['host']}" + (f" (rule {rec['rule']})" if rec["rule"] else ""))
+
+
+@app.command("record-payment")
+def record_payment(payee: str = typer.Option(..., help="Payee name"),
+                   account: str = typer.Option(..., help="IBAN, wallet or merchant id")) -> None:
+    """Record a payee you've actually paid, so future checks know them (stored as hashes only)."""
+    from . import payees
+
+    try:
+        payees.record(payee, account)
+    except PermissionError as exc:
+        console.print(f"[red]{exc}[/red]")
+        raise typer.Exit(3)
+    console.print(f"Recorded '{payee}'. Future payments to this exact account count as a known payee.")
+
+
+@app.command()
+def bench(
+    directory: Path = typer.Option(Path("scenarios"), "--dir", help="Folder of scenario YAML files"),
+    strict: bool = typer.Option(False, help="Exit non-zero if any decision differs from expected"),
+    verbose: bool = typer.Option(False, "-v", "--verbose", help="Show reasons for each scenario"),
+) -> None:
+    """Run the scenario set and report caught / missed / false positives."""
+    if not directory.is_dir():
+        console.print(f"[red]No scenario folder at {directory}[/red]")
+        raise typer.Exit(2)
+    results = bench_mod.run_all(directory)
+
+    table = Table(title=f"scamgate bench ({directory})")
+    for col in ("id", "label", "expected", "got", "score", "outcome"):
+        table.add_column(col)
+    colours = {"caught": "green", "ok": "green", "missed": "red", "false_positive": "yellow"}
+    for r in results:
+        got = r.verdict.decision.value
+        got_s = got if r.exact else f"[bold]{got}[/bold] (!)"
+        table.add_row(r.scenario_id, r.label, r.expected.value, got_s, str(r.verdict.risk_score),
+                      f"[{colours[r.outcome]}]{r.outcome}[/{colours[r.outcome]}]")
+    console.print(table)
+
+    if verbose:
+        for r in results:
+            console.print(f"\n[bold]{r.scenario_id}[/bold] {r.name}: {r.verdict.summary}")
+            for reason in r.verdict.reasons:
+                console.print(f"  +{reason.weight:<3} {reason.rule_id}: {reason.explanation}")
+
+    s = bench_mod.summarize(results)
+    console.print(
+        f"\nScams: {s['scams']}  caught: {s['caught']}  missed: {s['missed']}\n"
+        f"Legit: {s['legit']}  false positives: {s['false_positives']}\n"
+        f"Exact decision match: {s['exact_decision_match']}/{s['total']}"
+    )
+    console.print("[dim]Example scenarios only; these numbers are a regression check, not a real-world detection rate.[/dim]")
+    if strict and s["exact_decision_match"] != s["total"]:
+        raise typer.Exit(1)
+
+
+if __name__ == "__main__":
+    app()

scamgate/config/rules.yaml

@@ -0,0 +1,218 @@
+# scamgate rules config.
+# Each rule's weight is added to the risk score when it fires (score is capped at 100).
+# decision: score >= deny -> deny, score >= ask -> ask, otherwise allow.
+thresholds:
+  ask: 25
+  deny: 70
+
+rules:
+  # --- URL rules ---
+  url.unreadable:       { enabled: true,  weight: 40 }    # can't tell where the link goes: ask, never allow
+  url.blocklist:        { enabled: true,  weight: 100 }   # your own list (data/blocklist.txt)
+  # Known-bad-link feeds (cached by `scamgate update-feeds`, looked up offline).
+  # exact URL listed -> deny; exact host listed -> 75 (deny on its own);
+  # parent domain listed (domain feeds only) -> 50.
+  url.known_bad_feed:   { enabled: true,  weight: 100, host_weight: 75, parent_weight: 50 }
+  url.lookalike_brand:  { enabled: true,  weight: 60, exact_token_weight: 45, official_prefix_weight: 80 }
+  url.userinfo:         { enabled: true,  weight: 40, disguise_weight: 75 }  # 'paypal.com@evil.example'
+  url.ip_host:          { enabled: true,  weight: 40 }
+  url.punycode:         { enabled: true,  weight: 40 }
+  url.suspicious_tld:   { enabled: true,  weight: 20 }
+  url.intent_mismatch:  { enabled: true,  weight: 45, secret_weight: 80 }
+  url.credential_page:  { enabled: true,  weight: 25 }   # login page on an unrecognised site; waivable per host
+  url.domain_age:       { enabled: true,  weight: 30, min_age_days: 30 }  # only with SCAMGATE_RDAP=cache|live
+
+  # --- Payment rules ---
+  pay.new_payee_urgency:    { enabled: true, weight: 35 }
+  pay.bank_details_changed: { enabled: true, weight: 50 }
+  pay.irreversible_method:  { enabled: true, weight: 35, new_payee_transfer_weight: 25, new_payee_transfer_vop_match_weight: 10 }
+  pay.method_restricted:    { enabled: true, weight: 30 }
+  pay.over_budget:          { enabled: true, weight: 30 }
+  pay.pressure_phrases:     { enabled: true, weight: 35 }
+  pay.unbacked_known_claim: { enabled: true, weight: 15 }
+  pay.vop_mismatch:
+    enabled: true
+    weights: { no_match: 60, close_match: 25, unavailable: 10, match: 0 }
+
+lists:
+  brands:
+    paypal:  [paypal.com, paypal.me]
+    revolut: [revolut.com, revolut.me]
+    aib:     [aib.ie]
+    boi:     [bankofireland.com, boi.com]
+    stripe:  [stripe.com, stripe.network]
+    # Not amazonaws.com: its subdomains are customers' buckets and servers (S3, EC2, API Gateway).
+    amazon:  [amazon.com, amazon.co.uk, amazon.ie, amazon.de, amazon.fr, amazon.es, amazon.it, amazon.nl]
+    apple:   [apple.com, icloud.com]
+    # Brand pack: the names most used in phishing (APWG / vendor reports), plus Irish and UK banks,
+    # couriers and services. Exact-name and typo checks only; keep names that are also everyday
+    # words out (they'd flag normal sites), or list them under brand_typo_exempt.
+    microsoft:  [microsoft.com, microsoftonline.com, live.com, outlook.com, office.com, office365.com, azure.com, xbox.com]
+    outlook:    [outlook.com, live.com, microsoft.com, office.com]
+    office365:  [office.com, office365.com, microsoft.com]
+    google:     [google.com, google.ie, google.co.uk, gmail.com, youtube.com]
+    gmail:      [gmail.com, google.com]
+    netflix:    [netflix.com]
+    facebook:   [facebook.com, fb.com, meta.com]
+    instagram:  [instagram.com]
+    whatsapp:   [whatsapp.com, whatsapp.net]
+    linkedin:   [linkedin.com]
+    dropbox:    [dropbox.com, dropboxusercontent.com]
+    docusign:   [docusign.com, docusign.net]
+    adobe:      [adobe.com]
+    ebay:       [ebay.com, ebay.ie, ebay.co.uk]
+    coinbase:   [coinbase.com]
+    binance:    [binance.com]
+    metamask:   [metamask.io]
+    kraken:     [kraken.com]
+    dhl:        [dhl.com, dhl.ie, dhl.co.uk, dhl.de]
+    fedex:      [fedex.com]
+    anpost:     [anpost.ie, anpost.com]
+    royalmail:  [royalmail.com]
+    evri:       [evri.com]
+    usps:       [usps.com]
+    hmrc:       [hmrc.gov.uk, gov.uk]
+    ptsb:       [ptsb.ie]
+    bankofireland: [bankofireland.com, boi.com]
+    ulsterbank: [ulsterbank.ie, ulsterbank.co.uk]
+    hsbc:       [hsbc.com, hsbc.co.uk]
+    barclays:   [barclays.co.uk, barclays.com]
+    natwest:    [natwest.com]
+    santander:  [santander.co.uk, santander.com]
+    lloyds:     [lloydsbank.com, lloyds.com]
+    monzo:      [monzo.com]
+    starling:   [starlingbank.com]
+    bunq:       [bunq.com]
+    n26:        [n26.com]
+    klarna:     [klarna.com]
+    wellsfargo: [wellsfargo.com]
+    venmo:      [venmo.com]
+    cashapp:    [cash.app, cashapp.com]
+    airbnb:     [airbnb.com, airbnb.ie, airbnb.co.uk]
+    booking:    [booking.com]
+    ryanair:    [ryanair.com]
+    aerlingus:  [aerlingus.com]
+
+  # Everyday words one letter away from a brand ('finance' ~ 'binance'). The typo check skips them.
+  brand_typo_exempt: [finance, finances, kroken, broken, token, tokens, monza, months, mondo, lloyd, cashap,
+                      starting, startling, sparling, docusing, adore, adobo, netflux, ebays, fedx, bunk, bung,
+                      booking, cooking, looking, hooking, rooking, ryanairs, outlooks, metamorph, hsbcs, n25, n27,
+                      venom, venue, venus, klara, klarne]
+
+  # Padding scammers put around a brand name ('appleid', 'securepaypal', 'amazonrefund').
+  # A brand inside any other word ('applebees', 'revolution', 'pineapple') isn't flagged.
+  brand_affixes: [id, login, logon, signin, sign, secure, security, safe, verify, verification, verified, validate,
+                  support, help, helpdesk, desk, service, services, svc, account, accounts, acct, update, updates,
+                  billing, bill, pay, payment, payments, my, online, app, apps, web, portal, auth, alert, alerts,
+                  notice, center, centre, team, care, customer, customers, client, refund, refunds, unlock, unlocks,
+                  recovery, recover, restore, official, store, shop, gift, card, cards, wallet, connect, check, checks,
+                  confirm, mail, cloud, user, users, member, members, uk, ie, us, eu, de, global, inc, ltd, get, go,
+                  www, login, access, hub, info, dept, claim, claims, prize, reward, rewards, bonus, invoice, order,
+                  orders, delivery, track, tracking, case, review, reviews, limited, limit, suspend, suspended,
+                  locked, lock, block, blocked, protect, protection, fraud, team, official, net, com, now, here, x]
+
+  # Shared hosting: each hostname under these is a different customer's or user's site, so it's never an
+  # official brand site, and a feed listing counts only for that exact host (never as a parent domain).
+  #   amazonaws.com         S3 buckets, EC2, API Gateway (583 Public Suffix List entries)
+  #   googleusercontent.com Google's sandbox for untrusted user content (Apps Script web apps, Sites embeds)
+  #   cloudapp.azure.com    Azure VM names customers pick: <label>.<region>.cloudapp.azure.com
+  shared_hosting: [amazonaws.com, googleusercontent.com, cloudapp.azure.com]
+
+  # Big shared platforms (file hosts, form builders, shorteners, identity providers).
+  # Unlike shared_hosting, one host serves many users' pages here, so even an exact host listing is ignored.
+  # Feeds list single bad pages on these, so a host/domain hit here is ignored; only an
+  # exact-URL listing counts. Each entry also covers its subdomains.
+  feed_host_ignore:
+    - google.com
+    - googleapis.com
+    - forms.gle
+    - goo.gl
+    - microsoftonline.com
+    - microsoft.com
+    - live.com
+    - office.com
+    - sharepoint.com
+    - 1drv.ms
+    - discordapp.com
+    - discordapp.net
+    - github.com
+    - githubusercontent.com
+    - gitlab.com
+    - bitbucket.org
+    - dropbox.com
+    - dropboxusercontent.com
+    - mediafire.com
+    - pastebin.com
+    - t.me
+    - telegra.ph
+    - bit.ly
+    - tinyurl.com
+    - t.co
+    - linktr.ee
+    - ipfs.io
+    - facebook.com
+    - linkedin.com
+
+  suspicious_tlds: [zip, mov, top, xyz, click, country, gq, tk, ml, cf, ga, rest, cam, icu, sbs, cfd, shop, buzz, lol]
+
+  # URL terms that ask for credentials or secrets.
+  credential_terms: [login, log-in, signin, sign-in, verify-account, account-verify, unlock, password, otp, 2fa]
+  secret_terms: [seed, seed-phrase, seedphrase, mnemonic, recovery-phrase, private-key, privatekey, connect-wallet, wallet-connect]
+  # If the agent's stated intent contains one of these, credential terms are expected.
+  credential_intent_terms: [log in, login, sign in, signin, account, password, my bank, banking]
+
+  urgency_terms:
+    - urgent
+    - urgently
+    - immediately
+    - asap
+    - right away
+    - today
+    - within the hour
+    - end of day
+    - before close of business
+    - deadline
+    - final notice
+    - last chance
+
+  pressure_phrases:
+    - act now
+    - keep this confidential
+    - keep this between us
+    - do not tell the bank
+    - don't tell the bank
+    - do not tell anyone
+    - don't tell anyone
+    - guaranteed returns
+    - guaranteed return
+    - risk-free
+    - double your money
+    - police will
+    - arrest warrant
+    - your account will be closed
+    - do not call
+    - i'm in meetings
+
+  bank_change_phrases:
+    - new bank details
+    - changed our bank
+    - updated bank details
+    - updated account details
+    - new account details
+    - changed bank account
+    - new iban
+
+  method_restriction_phrases:
+    - only accept crypto
+    - crypto only
+    - only accept usdt
+    - only accept bitcoin
+    - usdt only
+    - bitcoin only
+    - gift card
+    - gift cards
+    - no cards
+    - no card payments
+    - bank transfer only
+    - only accept bank transfer
+    - friends and family