Category malicious-qr · 4/4 features · judges the final destination, not the short link
How to run: load the BDR extension + start the backend, then just open this page. The content script
decodes every QR image below and the QR-policy checker judges the resolved destination — you should see a BDR
notification / the QR image neutralised / an isolated-browser window, and a row on /bdr.
LOCAL cards fire offline; BACKEND cards need the backend enrichment (unfurl / domain-age / lake).
To make the reputation card deterministic, seed its host into the lake:
curl -s localhost:4004/api/reputation/bulk -X POST -H 'content-type: application/json' \
-d '{"items":[{"type":"domain","value":"qr-bad.viyuh-test.example"}]}' # (or add it via your lake importer)