# Feed attribution & license verdicts

Built for AI Agent Purgatory. Review before commercial distribution.

## Chosen (allowed for commercial product use)

### 1. Phishing.Database — **ALLOWED (MIT)**
- Source: https://github.com/Phishing-Database/Phishing.Database
- License: MIT — https://github.com/Phishing-Database/Phishing.Database/blob/master/LICENSE
- Verdict: Commercial use, modification, and redistribution permitted; keep copyright notice.
- File used: `phishing-domains-ACTIVE.txt`

### 2. PhishTank (OpenDNS/Cisco) — **ALLOWED (Data is commercial-OK)**
- Terms: https://phishtank.com/terms.php — “Data … available for commercial use without charge.”
- FAQ: https://phishtank.com/faq.php — commercial API use OK.
- Bulk: https://data.phishtank.com/data/online-valid.json.bz2 (app key recommended; rate limits apply)
- Verdict: OK to use Data in a commercial product. Register an app key for production. Data is as-is, no warranty.
- Status in builder: optional (`PHISHTANK_APP_KEY`); often 429 without a key.

### 3. abuse.ch URLhaus — **CONDITIONAL**
- About / vendor note: https://urlhaus.abuse.ch/about/
- Community API: https://urlhaus.abuse.ch/api/ — free under fair use; **commercial/for-profit may require** the paid Spamhaus-hosted abuse.ch API: https://www.spamhaus.com/data-access/abusech-api/
- Downloads now require an Auth-Key from https://auth.abuse.ch/
- Verdict: Fine to wire up with `URLHAUS_AUTH_KEY` for prototypes/fair use. For a **sold** product at scale, budget for Spamhaus commercial API (or omit URLhaus and rely on MIT + PhishTank).
- Status in builder: optional (`URLHAUS_AUTH_KEY`).

## Rejected for this commercial consumer product

### OpenPhish Community Feed — **REJECTED**
- Terms: https://openphish.com/terms.html — non-commercial only; no security-ops / product / customer-protection use without written consent.
- GitHub note: https://github.com/openphish/public_feed — “Non-commercial use only.”
- Premium feeds exist for commercial use (paid).

### Google Safe Browsing API — **REJECTED for commercial**
- Terms: https://developers.google.com/safe-browsing/terms — commercial use prohibited without separate agreement.
- Appropriate usage: https://developers.google.com/safe-browsing/reference/Appropriate.Usage — non-commercial only.
- Commercial path: **Google Cloud Web Risk** (paid after free tier) — https://cloud.google.com/web-risk/pricing — not wired in (needs GCP billing). Optional future add-on.

## How updates would be hosted later (not done in this task)

1. Run `build_feed.py` on a schedule (e.g. GitHub Action / small VPS) every 1–4 hours.
2. Upload `out/blocklist.json` + `out/blocklist.sha256` to HTTPS object storage (Cloudflare R2 / S3 / GitHub Releases).
3. Point the extension `UPDATE_URL` at that JSON (and optionally a separate `.sha256` URL).
4. Extension verifies SHA-256 before applying; falls back to bundled list if offline or hash mismatch.