How MISUIC reaches a verdict

Every rule below is deterministic: given the same URL and the same cached reputation, MISUIC returns the same answer every time, and nothing on this ladder calls a model. That makes a rule ladder verdict a fast, repeatable first-pass signal, not a final word: it is not conclusive on its own. A URL that stays inconclusive after every rule below rests at "unknown." MISUIC is built the way Michelle builds this whole ecosystem: run cheaply on modest, older hardware first, then add newer hardware and GPU-backed checks deliberately, for accuracy and coverage, where they earn their keep rather than by default. A GPU-backed cross-check for exactly the URLs that stay inconclusive here is that step, and it exists today as an optional bolt-on. It is reached by a remote call, which is what keeps it optional: the ladder never waits on it, and a deployment without it loses nothing.

Where it sits

MISUIC runs as a small, standalone scanner registered with the mail proxy's own filtering engine, checked against every URL a message contains before the message is scored:

"Dangerous" is the one verdict that decides on its own: it scores above the threshold that alone adds a warning, and it is not overridable downstream. "Malicious," "spam" and "safe" all sit below that threshold, so they corroborate the wider pipeline's judgement rather than overriding it outright, and malicious/spam are the two severities that stay overridable further down the pipeline.

The rule ladder

A URL is checked against each rule in order. Rules 2 through 4 look for structural impersonation; rule 5 only ever corroborates one of them, and never condemns a URL by itself; rule 0 is the only path to a "safe" verdict, and only when nothing else has already condemned the URL. Every rule that can condemn a URL below lands on the top severity, "dangerous," regardless of which one fired: impersonating a brand is scam/phishing behaviour by nature, so structure alone earns the top tier. The graduated "malicious" and "spam" severities come from a different source entirely -- see the next section.

Reading the reputation cache

MISUIC shares a single host-keyed reputation cache with the wider content-classification pipeline it sits in front of, so a host confirmed once by either side is never re-litigated by the other. Two rules apply strictly:

• Only confirmed entries count. An unconfirmed sighting, one that has not yet been corroborated, never changes a verdict on its own.
• A confirmed-good host is matched as that exact host, never widened to its registrable parent domain. Trusting mail.example.com must never hand out trust to every other subdomain of example.com.

Grading a confirmed-bad host

A confirmed-bad host carries its own recorded category, and that category is what decides its severity, rather than every confirmed-bad host flooring at "dangerous" the way it used to:

A host with no category on file floors at "dangerous" rather than quietly downgrading it: that is the conservative default, and it is the same strictness every confirmed-bad host had before this grading existed.

Cloaked pages are condemned automatically

A phishing kit that shows a clean page to anything that looks like an inspector, and the real payload only to a victim, is hiding because it has something to hide. MISUIC treats that behaviour as the finding itself, not as a gap in the evidence: a destination that serves different content depending on who is asking is condemned automatically, without a person needing to look at it first.

The reverse is deliberately not true. A clean-looking fetch never exonerates a host, because a clean page is exactly what cloaking serves an inspector: a probe can accuse, it can never clear. Only positive standing (rule 0) reaches "safe."

The optional inline bolt-on

The rule ladder judges a URL before anyone clicks it. For deployments that want a look at the page itself, there is an optional bolt-on through MISUIC's API. The proxying is the mail proxy's job, not MISUIC's: when a link is clicked, the mail proxy looks up the destination's returned page and proxies it inline to the end user, so nothing waits on a verdict before the page starts to arrive. In parallel, it hands that same returned content to MISUIC over the API, where it is checked, optionally by GPU-backed models, and the verdict goes back to the proxy to act on. MISUIC itself still only classifies.

• Parallel, not serial. The user is not held at a checkpoint while a model thinks; the check runs alongside delivery.
• Nothing to cloak against. The content MISUIC checks is the same response the mail proxy is delivering to the user, so the checker sees exactly what the user sees, and a page that behaves differently for an inspector has no inspector to behave differently for.
• Optional because it is a remote call. The GPU-backed models sit behind the API rather than inside the ladder. Without them the bolt-on is simply absent and the rule ladder carries on exactly as it does on its own.
• Same fail-open principle. A bolt-on that errors, or a GPU that is not there, only ever removes the extra check, never the page.

The fail-open contract

Any internal error, a cache that cannot be reached, a malformed request, an unexpected exception, is MISUIC's own problem and is reported as such. The mail path continues exactly as if MISUIC were not there: it can only ever add caution, never block delivery by failing.

Worst wins

A message can contain many URLs. MISUIC checks every one and reports the single worst rating found, with the URL and the rule that produced it. The severity ladder, from best to worst, is safe/none, unknown, spam, malicious, dangerous: a "safe" verdict is only reachable when every URL in the message is safe, and a single dangerous URL outranks every other URL in the message, whatever their own ratings.