Threat feed status ◉
Awaiting
Source: Phishing.Database
THREAT INTELLIGENCE · FIELD LABORATORY
Fraud signals. Real context.
A focused workspace for checking suspicious domains, messages and payment instructions — with source-level transparency.
Domains in checked feed ◎
—
Provider's active-domain list
Source snapshot entries ↗
—
Provider-defined new-today file
Last retrieved ◷
—
Retrieved ≠ last updated by source
QUICK ACTION
Check a suspicious website
⌕
Compare a hostname to community-maintained phishing indicators and inspect the URL structure. The site will not be opened.
↗
✓ Exact source matching✓ Explainable output✓ No website crawling
BUILD STATUS
What is actually working?
✓
Message + URL heuristicsClient-side rule-based assessment
ACTIVEInvoice account comparisonRequires trusted reference data
ACTIVEOpen threat intelligence feedChecking availability
CHECKINGTrained AI correlation engineFuture R&D objective
PLANNEDPUBLIC DATA · SOURCE ATTRIBUTION
Recent source indicators —
Examples from the feed provider's new-today snapshot, not an independently verified list of offenders.
DOMAIN INDICATORFEEDSOURCE STATUS
Retrieving the public indicator source…
Provider update time is not independently validated.Source & correction process ↗
ASSESSMENT ENGINE · VERSION 0.2
Investigate a potential scam.
Combine text, document and domain indicators. Results are warnings, not definitive fraud judgments.
RULE-BASED · EXPLAINABLE
New assessment
Select what you'd like to examine.
Domain indicators are retrieved from public data. We do not visit the website.
♧ Text-based scanning runs in the browser. The public-domain feed may be downloaded, and domain lookups may go to this site's serverless endpoint when available. Do not enter confidential data into this research demo.
Explainable assessment
Awaiting analysis
NOT ANALYZED—
—
A clearer answer begins with evidence.
Run an assessment to see the evidence used, what's missing and the recommended next action.
EVIDENCE & COVERAGE
No findings yet. You can start with a synthetic scenario.
NEXT ACTION
Verify payment and account details through an independent trusted channel.
Heuristic output is not a fraud verdict, security certification or automated payment decision.
SOURCE LIBRARY · PUBLIC INDICATORS
Threat intelligence, with provenance.
Search publicly reported domain indicators. We do not publish names of alleged offenders or unreviewed accusations.
DOMAIN LOOKUP
Search a reported indicator
Match a domain against the provider's active-domain dataset. Negative results do not certify a domain as safe.
⌕
Enter a domain to search its listing status.
PROVIDER SNAPSHOT
Indicators in the source file
Names are shown as plain text to avoid accidentally opening suspicious sites.
Retrieving threat intelligence…
EVIDENCE POLICY
Why sources matter
01
Source before assertion
Every listed domain is attributed to the dataset provider, not a proprietary verification result.
02
No naming and shaming
We do not maintain a public list of accused people, phone numbers or businesses.
03
Absence is not safety
A domain missing from a source can still be malicious. A stale listing can be a false positive.
04
Provider's corrections & false-positive reports ↗Corrections and appeals
Disputed indicators must be challenged with the original source and reviewed before reuse.
Data source: Phishing.Database (MIT). Feed retrieval status and time are displayed transparently.
RESEARCH NOTICES
Show the logic. Not false certainty.
Scope, constraints and methods used by this public proof of concept.
Transparent URL checks
Local structural rules inspect protocol, domain composition and redirection-like characteristics. They do not resolve DNS, inspect TLS certificates or visit target websites.
Attributed public feeds
Only domain strings are compared against the retrieved Phishing.Database active-domain feed. The provider's status and correction mechanism remain authoritative for that dataset.
Invoice correlation
Text extraction plus manual comparison of invoice IBAN and email sender domain against user-provided trusted references. No banking ownership verification is performed.
Research, not AI
No trained model, validated accuracy, automated fraud adjudication or storage of submissions is included. Full AI correlation is planned future work, not a current claim.
Privacy & limitations. Public feed data is retrieved via a Netlify endpoint when deployed with Functions, otherwise downloaded directly from the source. The site's backend may receive only the searched hostname, never the message, invoice text or uploaded PDF. You should not submit real confidential documents to the prototype. No information stored by this app intentionally; platform request logs may exist. Source & license ↗