🧪 VIYUH BDR TEST — SAFE LOCAL SIMULATION (not a real site, nothing is sent anywhere)

Known-Phishing Reputation (the data-lake / threat-feed list)

This page pretends to be: a "directory" of links — but four of them go to domains that are already on VIYUH's known-phishing list (seeded in the Redis lake / fed by threat-intel feeds).
The trick: these are not look-alike / typo domains — they are real addresses that VIYUH has been told are confirmed phishing, so they should be hard-blocked on sight, before the page even loads.
✅ With VIYUH BDR ON you SHOULD see: clicking a RED "BLOCKS" card flips the tab to a full-screen RED block page ("VIYUH BDR blocked this page") — a hard block with no "Proceed anyway" button. Reason will read phish-reputation.
Clicking the GREEN "SAFE CONTROL" card (example.com) should do nothing — the real page loads, no block, no warning.

👉 Mark PASS if you saw that, FAIL if you didn't.

How to test: make sure the BDR extension is loaded and the backend is running, then click each card below. A known-bad domain triggers on the navigation itself — the moment the tab tries to open it, BDR checks the address against the lake (bdr:phish:domain:*) and the live feeds, and slams a block page in front of it.

Click a RED card → expect the full-screen RED block page (hard block, no proceed button).
Hit your browser's Back button, then try the next card.
Finish with the GREEN safe control → expect a normal page, no block. That proves BDR isn't blocking everything.

🚫 Known-phishing domains — BDR must hard-BLOCK each one

On the phishing listBLOCKS

http://account-verify-now.top

"Verify your account now" lure domain. Confirmed phishing in the lake → flagged the instant you navigate to it.

Click to test → expect RED block page →

On the phishing listBLOCKS

http://mfa-reauth-required.app

"Your MFA needs re-authentication" lure domain. Confirmed phishing in the lake → hard block.

Click to test → expect RED block page →

On the phishing listBLOCKS

http://secure-update-portal.xyz

"Secure update portal" lure domain. Confirmed phishing in the lake → hard block.

Click to test → expect RED block page →

On the phishing listBLOCKS

http://wallet-restore-help.live

"Restore your crypto wallet" lure domain. Confirmed phishing in the lake → hard block.

Click to test → expect RED block page →

🧬 Parent-walk — a SUBDOMAIN of a known-bad domain must also block

v0.5.0 walks up the domain tree: if secure-update-portal.xyz is bad, then anything under it is bad too. Attackers love hiding on subdomains like verify. or login. — these must block the same as the parent.

Subdomain of a known-bad domain parent-walkBLOCKS

http://verify.secure-update-portal.xyz

The parent (secure-update-portal.xyz) is on the list, so this verify. subdomain inherits the verdict → hard block.

Click to test → expect RED block page →

Subdomain of a known-bad domain parent-walkBLOCKS

http://login.account-verify-now.top

The parent (account-verify-now.top) is on the list, so this login. subdomain inherits the verdict → hard block.

Click to test → expect RED block page →

✅ Safe control — BDR must stay SILENT

A normal, well-known site (NOT on any list)STAYS SILENT

http://example.com

This is the control. It is not in the lake and is not a look-alike of anything. BDR should let it load normally — no block, no warning. If this gets blocked, that's a false positive → FAIL.

Click to test → expect a NORMAL page (no block) →

Why these aren't "look-alike" detections: the homograph / brand-impersonation features only catch domains that resemble a real brand (e.g. micros0ft.com). These four don't resemble anyone — the only reason BDR knows they're bad is the reputation list. The block page reason field will say phish-reputation, severity high, confidence 5 (definitive) → that's why it's a hard block with no "Proceed anyway", unlike the amber look-alike warnings.