← Category 2 index Β· master console

πŸ”΄ Category 2 β€” LIVE Tests (real-world)

Each feature tested through a REAL delivery channel (email / social / real hosts), not just the localhost fixtures. Steps + expected result for all 14.
Before you start: extension v0.8.7 reloaded Β· backend :4004 up Β· keep chrome://extensions β†’ VIYUH BDR β†’ service worker console open Β· allow Chrome notifications (for download + banner cases). Most responses are WARN (proceed-able) or BANNER (in-page) β€” precision-first.
4 Β· Suspicious redirectswarn
  1. Create a real bit.ly that points to http://paypa1.com/.
  2. Email it to yourself; open in Gmail and click it.
Expect: the shortener expands server-side and you get a WARN at the look-alike terminus (paypa1) β€” your machine never reaches it.
5 Β· eTLD typosquatwarn
  1. Self-email (or SMS) a link to http://paypal.co/ (or microsoft.help).
  2. Open in real Gmail and click the link.
Expect: amber WARN interstitial in the real tab β€” "look-alike TLD". (This is exactly how these arrive β€” phishing email/SMS.)
6 Β· Unicode / IDNwarn
  1. Self-email a link to http://xn--pypal-4ve.com/ (renders as pΠ°ypal.com).
  2. Click it from Gmail.
Expect: WARN β€” unicode look-alike, on a real navigation.
7 Β· Free-hosted sitewarn
  1. Create a free Glitch/Netlify/Weebly site with a brand in the subdomain (e.g. a Glitch project paypal-verify β†’ paypal-verify.glitch.me).
  2. Open it (or email yourself the link and click from Gmail).
Expect: WARN β€” brand cue on a real free host. (A normal blog with no brand stays silent.)
8 Β· Social-referrerwarn
  1. On real facebook.com / instagram.com, post or DM a link to http://paypa1.com.
  2. Click it from there.
Expect: WARN β€” risky site opened from a social network. (facebook β†’ nytimes stays silent.)
9 Β· Legit-service phishing
  1. Create a real Google Form; add a question/field labelled "Password"; open the LIVE form (docs.google.com/forms/.../viewform).
  2. Or add a paypa1.com link to a real Canva design and open it.
Expect: in-page BANNER β€” never blocks the legit Google/Canva page. (A normal survey form stays silent.)
10 Β· Multi-hop phishingwarn
  1. Share a real SharePoint/OneDrive/Drive doc that links onward to http://paypa1.com/.
  2. Open the share link β†’ click through (same tab).
Expect: WARN β€” multi-hop via a trusted service to a look-alike terminus.
11 Β· Page-content filterwarn
  1. Host page-content/account-suspended.html on a real domain (any free host), or open a real phishing page from a quarantined email.
  2. Click it (e.g. from Gmail).
Expect: WARN β€” login form + lure text on a real navigation. (A normal login stays silent.)
12 Β· Clickjacking frame
  1. Host clickjacking/clickjacking.html on a real domain (free host) and open it.
Expect: in-page BANNER β€” invisible overlay frame, confirmed on a real origin. (Visible iframes / cookie modals stay silent.)
13 Β· Magecart / formjacking
  1. No-false-positive check (critical): open a REAL checkout you trust β€” Amazon, a Shopify store, any Stripe-powered site β€” and watch the console.
  2. For a positive: host magecart/fake-checkout.html on a real domain.
Expect: real PSP checkouts stay SILENT (Stripe/PayPal/analytics allowlisted); only an untrusted skimmer script fires a BANNER.
14 Β· Drive-by downloadblock
  1. From a look-alike / cheap-TLD host, download an executable. Safe option: rename the harmless EICAR test file to .exe and serve it from a free/cheap-TLD host, then download it.
  2. Or self-email a link to redirects/driveby.html and click "Update now".
Expect: the download is cancelled + deleted, with a "Dangerous download blocked" notification. (A normal .pdf, or an .exe from github.com, is allowed.)
15 Β· Malvertising / scamwarn
  1. Visit a known tech-support-scam URL (from a threat feed like URLhaus), or host malvertising/fake-virus-alert.html on a real domain.
Expect: WARN β€” fake-alert / tech-support / prize scam (β‰₯2 cues). A news article mentioning one cue stays silent.
16 Β· Geo-blockingwarn
  1. Find a site whose hosting IP is in a high-risk country β€” check via POST {domain} to :4004/api/web-attacks/geo.
  2. Add that country to the policy high-risk list (default KP/IR/SY), then visit it.
Expect: WARN β€” hosted in a high-risk country. CDN-fronted sites (Cloudflare etc.) are excluded.
17 Β· Newly-registered domainwarn
  1. Find a genuinely <30-day-old domain (newly-registered feeds / whoisds).
  2. Confirm via POST {domain} to :4004/api/web-attacks/domain-age (returns ageDays), then visit it.
Expect: WARN β€” newly-registered domain. (Aged domains like google.com β†’ registered 1997 stay silent.)