Phishing / malicious-URL screen — URLhaus blocklist snapshot + deterministic live heuristics (punycode/homograph, brand lookalike, URL shape, opt-in redirect chain)