Upload folder using huggingface_hub

app/validator/mx_intel.py

@@ -30,8 +30,11 @@ _MX_PATTERNS: tuple[tuple[str, str, bool, bool], ...] = (
     ("office365.com", "microsoft365", True, False),
     ("mimecast.com", "mimecast", True, False),
     ("pphosted.com", "proofpoint", True, False),
+    ("ppe-hosted.com", "proofpoint", True, False),
     ("proofpoint.com", "proofpoint", True, False),
     ("barracudanetworks.com", "barracuda", True, False),
+    ("mailchannels.net", "mailchannels", True, False),
+    ("emailsecurity.app", "emailsecurity", True, False),
     ("yahoodns.net", "yahoo", False, True),
     ("yahoo.com", "yahoo", False, True),
     ("aol.com", "yahoo", False, True),
@@ -42,6 +45,18 @@ _MX_PATTERNS: tuple[tuple[str, str, bool, bool], ...] = (
     ("protonmail.ch", "proton", False, True),
     ("proton.me", "proton", False, True),
     ("secureserver.net", "godaddy", False, False),
+    ("registrar-servers.com", "namecheap", False, False),
+    ("ionos.com", "ionos", False, False),
+    ("1and1.com", "ionos", False, False),
+    ("serverdata.net", "serverdata", False, False),
+    ("hostgator.com", "hostgator", False, False),
+    ("bluehost.com", "bluehost", False, False),
+    ("siteground.com", "siteground", False, False),
+    ("dreamhost.com", "dreamhost", False, False),
+    ("networksolutions.com", "netsol", False, False),
+    ("rackspace.com", "rackspace", False, False),
+    ("emailsrvr.com", "rackspace", False, False),
+    ("workmail.com", "amazon", False, False),
     ("fastmail.com", "fastmail", False, True),
     ("messagingengine.com", "fastmail", False, True),
     ("yandex.net", "yandex", False, True),
@@ -88,12 +103,19 @@ _TRUSTED_MX_PROVIDERS = frozenset({
     "google",        # Google Workspace (paid for custom domains)
     "microsoft365",  # Microsoft 365 / Exchange Online
     "mimecast",      # enterprise email security gateway
-    "proofpoint",    # enterprise email security gateway
+    "proofpoint",    # enterprise + Essentials gateway (pphosted/ppe-hosted)
     "barracuda",     # enterprise email security gateway
+    "mailchannels",  # mail infrastructure for hosting providers (paid)
+    "emailsecurity", # hosted email security gateway
     "zoho",          # Zoho Mail (paid for custom domains)
     "proton",        # Proton Business
     "fastmail",      # Fastmail (paid custom domain)
     "apple",         # iCloud+ Custom Email Domain
+    # Business hosting / mailbox providers: a paid, domain-verified account is
+    # required, so their customers are real businesses (observed in the user's
+    # 800-row export: ionos, namecheap, serverdata).
+    "godaddy", "namecheap", "ionos", "serverdata", "hostgator",
+    "bluehost", "siteground", "dreamhost", "netsol", "rackspace", "amazon",
 })
 
 

tests/test_trusted_mx.py

@@ -0,0 +1,60 @@
+import unittest
+
+from app.validator.mx_intel import mx_is_trusted
+
+
+class TrustedMxProviderTests(unittest.TestCase):
+    """Direct coverage of the trusted-MX gate.
+
+    The gate decides whether the ML advisory may speak at all: a trusted host
+    means "paid business mail platform, disposable domains are implausible
+    here". Missing a real provider therefore re-introduces the exact false
+    positive the gate exists to prevent (a legitimate SMB flagged disposable).
+
+    Providers below were observed in the user's real 800-row export.
+    """
+
+    TRUSTED = [
+        # enterprise platforms
+        "aspmx.l.google.com", "alt3.aspmx.l.google.com", "smtp.google.com",
+        "aspmx2.googlemail.com",
+        "contoso-com.mail.protection.outlook.com",
+        # email-security gateways in front of corporate mail
+        "mx1-us1.ppe-hosted.com", "mx2-usg2.ppe-hosted.com",
+        "mx1.mailchannels.net", "mx1-us.emailsecurity.app",
+        # business hosting / mailbox providers (paid custom domains)
+        "mx00.ionos.com", "mx01.ionos.com",
+        "eforward1.registrar-servers.com", "eforward2.registrar-servers.com",
+        "west.smtp.mx.exch122.serverdata.net",
+        "mx.zoho.com", "mx1.fastmail.com", "mail.protonmail.ch",
+        "mx01.mail.icloud.com",
+    ]
+
+    UNTRUSTED = [
+        # self-hosted / unknown MX: nowhere near enough signal to skip the model
+        "mail.abcoimport.com", "mx.sketchy-host.test", "mx.example.com",
+        "tempmail.example.net",
+        # spoof-adjacent hostnames must NOT match a trusted suffix
+        "google.com.evil.test", "notgoogle.com", "xn--google.com",
+        "protection.outlook.com.evil.test", "fake-ppe-hosted.com",
+    ]
+
+    def test_real_business_providers_are_trusted(self):
+        untrusted = [h for h in self.TRUSTED if not mx_is_trusted(h)]
+        self.assertEqual(untrusted, [], f"legit providers not trusted: {untrusted}")
+
+    def test_unknown_and_spoofed_hosts_are_not_trusted(self):
+        trusted = [h for h in self.UNTRUSTED if mx_is_trusted(h)]
+        self.assertEqual(trusted, [], f"untrustworthy hosts trusted: {trusted}")
+
+    def test_matching_is_case_and_trailing_dot_insensitive(self):
+        for host in ("ASPmx.L.Google.COM", "aspmx.l.google.com.", "  aspmx.l.google.com  "):
+            self.assertTrue(mx_is_trusted(host), host)
+
+    def test_empty_and_none_are_not_trusted(self):
+        self.assertFalse(mx_is_trusted(""))
+        self.assertFalse(mx_is_trusted(None))
+
+
+if __name__ == "__main__":
+    unittest.main()