Master test console — every Category-2 feature, with local fixtures (▌red = should DETECT · ▌green = control, should NOT) and live real-site test cases.
Domain & navigation
geo-blocking · #16
🌍 Geo-blocking
Blocks sites hosted in an admin-selected high-risk country (geoip on the resolved IP). Policy block — re-enforces every visit.
LIVE: enable KP/IR/SY/RU in Web Filtering, then click through the geo test-sites page (blocks by ccTLD + hosting; controls must NOT block).
Expect: hard BLOCK on every refresh.
newly-registered-domain · #17
📅 Newly-registered domain
Warns on a domain registered within the threshold (default 30d) using the local NRD lake.
LIVE: visit modern-sales-academy.com (a real ~3-day-old domain).
Expect: proceed-able WARN ("registered N days ago").
etld-typosquat
🔤 eTLD / TLD typosquat
A real brand name on an abused TLD (paypal.co), incl. hyphen tokens (secure-paypal.co).
LIVE: type paypal.co or secure-paypal.top in the address bar.
Expect: look-alike WARN (fires on navigation).
unicode-domain-policy
🔠 Unicode / IDN look-alike
Mixed-script (Latin+Cyrillic) IDN spoofs. Accented Latin (münchen/café) is NOT flagged (P2).
LIVE: type xn--pypal-4ve.com (spoof → fires) vs münchen.de (accented → silent).
Expect: spoof isolates/warns; accented Latin loads normally.
free-hosted-site-isolation · #7
🆓 Free-hosted site
A brand cue on a free host (paypal-login.weebly.com). Blanket isolate-all is now OFF by default (P1).
LIVE (control): a normal *.vercel.app / vercel.com should load NORMALLY now.
Expect: brand-on-free-host warns; plain dev sites silent.
social-referrer-isolation · #8
📲 Social-referrer
A risky site opened FROM a social network (ad/DM → phish). Delivery-vector enricher.
LIVE: from a real X/LinkedIn/Telegram post, click a link to a look-alike.
Expect: 📲 social vector stamped on the terminus detection.
suspicious-redirects · #4
↪️ Suspicious redirects
Cross-domain redirect chains, open-redirect params (path/hash too — P14), meta-refresh, storm. Affiliate→legit chains now silent (FP fix).
LIVE (control): open betting-site affiliate links — should NOT flag (terminus is legit).
Expect: look-alike/cloaking chains warn; affiliate/marketing chains silent.
multi-hop-phishing · #10
🔗 Multi-hop phishing
A trusted-service link (SharePoint/Drive/Docs) that leads to a look-alike OR a credential page (SquareX scenario).
LIVE: open real drive.google.com, then in the same tab go to paypa1.com (or email yourself a Drive link → terminus).
Expect: multi-hop WARN ("a drive.google.com link led to …").
Page content, scripts & downloads
legit-service-phishing · #9 + SquareX policy
🪪 Legit-service phishing
A login form / brand login on a trusted productivity service. Admin policy can BLOCK all logins originating from SharePoint (excl. trusted IdPs).
POLICY: turn ON "Block login forms from trusted services" in Agents → re-run the SharePoint→credentials multi-hop fixture → hard BLOCK.
Expect: legit-service banner; with policy → block.
content-category-filter SquareX
🚫 Content-category filter
Blocks gambling / adult / drugs / … by live page content (keyword + domain-DB). Precision-gated.
LIVE: enable a category in Web Filtering, then visit bet365.com (gambling).
Expect: blocked pages → policy block; controls load normally.
canvas-content-filter · #11
📝 Page-content lure
A login page carrying social-engineering lure text on a non-brand domain. Now needs ≥2 lures or 1 lure+brand (P18).
Expect: lure+login warns; a normal login or a single generic phrase stays silent.
clickjacking-frame · #12
🖱️ Clickjacking
An invisible cross-origin iframe overlay that captures clicks. Now requires a positive z-index (P17).
Expect: stacked invisible overlay warns; consent/visible/same-origin frames silent.
magecart-formjacking · #13
💳 Magecart / formjacking
A checkout page (card fields) loading a 3rd-party script from a look-alike / abused-TLD / free host. Legit .io vendors no longer flagged (P4).
Expect: skimmer-host script warns; PSP/CDN/analytics scripts silent.
malvertising · #15
📢 Malvertising / scam page
Tech-support scam / fake virus alert / prize scam landing pages (≥2 cues). AV-vendor pages now allowlisted (P18).
Expect: scam pages warn; normal/AV pages silent.
malicious-script-driveby · #14
⬇️ Drive-by download
A dangerous executable download from a risky source. Hardened ext parsing (P9); reputable-source carve-out before destroy (P10).
LIVE: the console uses a 127.0.0.1.nip.io source so the cross-origin download actually starts.
Expect: dangerous download blocked + removed (notification); ambiguous mac/linux installers flagged, not destroyed.
phish-reputation
🗄️ Known-bad reputation
Page/link/POST-target host matched against the Redis phishing lake (121k+) + live TI feeds. Low-confidence feeds now warn, not block (P3).
Expect: known-bad → block/warn by confidence; clean → silent.