laya-phishield

PayPal Security <no-reply@paypal-account-verify.example>

confirm your password within 24 hours

0.59the wide question

one big question is the wrong question.

first, what code can see for free.

display name claims a brand it does not own no other header or URL flag fires

deterministic pre-pass: reply-to, IP-literal and punycode links, homoglyph domains, SPF/DKIM

eight narrow questions, one forward pass.

a local decision model · cpu · $0

0.990phishing

why

asks_credentials+2.56

urgency_pressure+1.86

external_link_risk+1.56

the verdict names what pushed it.

Release notes 1.4.2Alice Nguyen <alice.nguyen@acme-corp.example>

0.053legitimate

the same pipeline waves it through.

laya-phishield

eight narrow questions, one verdict, every reason named.

AUC 0.9531  ·  recall +21.8 pt vs the wide question  ·  $0 per 1,000 emails