GSB priority in green channel

smishing_detector/predictor.py

@@ -293,35 +293,64 @@ class SmishingPredictor:
             risk = "low"
             return label, risk, final_prob, False, ""
 
-        # Build unified legit domain set (safe_browsing + data_loader)
-        legit_domains = set()
+        # Build static legit domain set (fallback whitelist)
+        static_legit = set()
         try:
             from utils.safe_browsing import get_checker
-            legit_domains |= get_checker().fallback_legit_domains
+            static_legit |= get_checker().fallback_legit_domains
         except Exception:
             pass
         try:
             from utils.data_loader import LEGIT_DOMAINS
-            legit_domains |= LEGIT_DOMAINS
+            static_legit |= LEGIT_DOMAINS
         except Exception:
             pass
 
         has_url = bool(uf.get("has_url"))
         has_suspicious = bool(uf.get("suspicious_tld") or uf.get("has_ip_url"))
 
-        # Case 1: Message has URLs — check if ALL are legit
+        # Case 1: Message has URLs — check each via GSB then static whitelist
         if has_url and not has_suspicious:
             try:
                 import tldextract
                 urls = extract_urls(message)
                 if urls:
+                    checker = None
+                    try:
+                        from utils.safe_browsing import get_checker as _gc
+                        checker = _gc()
+                    except Exception:
+                        pass
+
                     all_legit = True
+                    malicious_found = False
                     for url in urls:
                         ext = tldextract.extract(url)
                         full_domain = f"{ext.domain}.{ext.suffix}".lower().strip(".")
-                        if full_domain not in legit_domains:
+                        if not full_domain:
+                            continue
+
+                        # GSB first (cached, live lookup if needed)
+                        status = "unknown"
+                        if checker:
+                            try:
+                                status = checker.check_domain_status(full_domain)
+                            except Exception:
+                                pass
+
+                        if status == "known_malicious":
+                            malicious_found = True
+                            break
+                        elif status == "known_safe":
+                            continue  # GSB verified safe
+                        elif full_domain in static_legit:
+                            continue  # static whitelist
+                        else:
                             all_legit = False
                             break
+
+                    if malicious_found:
+                        return "spam", "high", max(final_prob, 0.90), False, ""
                     if all_legit:
                         return "safe", "low", min(final_prob, 0.40), True, \
                             "all URLs verified as legitimate domains"

smishing_detector/utils/data_loader.py

@@ -53,8 +53,7 @@ LEGIT_DOMAINS = {
 }
 
 TRUSTED_TLDS = {
-    "com", "org", "net", "edu", "gov", "gov.in", "co.uk", "au",
-    "ca", "de", "fr", "in", "co.in", "sbi",
+    "gov", "gov.in", "edu", "sbi",
 }
 
 URL_FEATURE_COLS = [