Update main.py

main.py

@@ -362,21 +362,43 @@ async def run_sandbox_endpoint(payload: SandboxRequest):
                 scripts = await page.evaluate("() => Array.from(document.querySelectorAll('script[src]')).map(e => e.src)")
 
                 # ── Indicator Analysis ──────────────────────────────
+                from urllib.parse import urlparse
+
+                def get_base_domain(url):
+                    try:
+                        netloc = urlparse(url).netloc.lower().replace('www.', '')
+                        parts = netloc.split('.')
+                        return '.'.join(parts[-2:]) if len(parts) >= 2 else netloc
+                    except:
+                        return ''
+
+                target_base = get_base_domain(target_url)
                 indicators = []
 
-                if redirect_chain:
-                    indicators.append(f"Redirected {len(redirect_chain)} time(s): {[r['url'] for r in redirect_chain]}")
+                # Only flag redirects that go to a DIFFERENT base domain
+                for r in redirect_chain:
+                    r_base = get_base_domain(r['url'])
+                    if r_base and r_base != target_base:
+                        indicators.append(f"Redirected to different domain: {r['url']}")
 
+                # Only flag forms posting to a completely different domain
                 for form in forms:
-                    if form and target_url and not form.startswith(target_url):
+                    if not form:
+                        continue
+                    form_base = get_base_domain(form)
+                    if form_base and form_base != target_base:
                         indicators.append(f"Form posts to external domain: {form}")
-                    if form and any(kw in form.lower() for kw in ["login", "verify", "secure", "account", "update"]):
+                    if any(kw in form.lower() for kw in ["login", "verify", "secure", "account", "update"]):
                         indicators.append(f"Form action contains suspicious keyword: {form}")
 
+                # Only flag scripts from a completely different domain
                 for script in scripts:
-                    if script and target_url and not script.startswith(target_url):
-                        indicators.append(f"External script loaded: {script}")
-                    if script and "cookie" in script.lower():
+                    if not script:
+                        continue
+                    script_base = get_base_domain(script)
+                    if script_base and script_base != target_base:
+                        indicators.append(f"External script from unrelated domain: {script}")
+                    if "cookie" in script.lower():
                         indicators.append(f"Script references cookies: {script}")
 
                 # ── Verdict Derivation ──────────────────────────────