+ Reputation / data lake (HIGH). These are not brand look-alikes — pattern features wouldn't catch them. They're seeded in the BDR Redis lake (bdr:phish:domain:*), so the reputation-checker flags them. Incident: bdr:phish-reputation.
Click each (HIGH — known phishing):
Negative — not in the lake: http://example.com
Add more: edit bdr/bdr-backend/src/data/phish-seed.js → npm run seed.