SponsorGuard
LIVEA sponsorship-scam detector where every point of the score is backed by evidence you can read.
SponsorGuard analyses a raw email (.eml, or Gmail → Show original) and returns a scored verdict for fake brand-deal and sponsorship offers sent to content creators. It is deliberately rule-based: every finding quotes the literal offending string, so the verdict can be read and justified rather than trusted blindly.
The problem
Creators are a high-value phishing target: a fake sponsorship from a lookalike brand domain, a "creative brief" in a password-protected archive, and a login page that harvests the channel. Google’s threat team has tracked campaigns of this shape hitting creators at scale.
Generic spam filters score these as ordinary business mail, and ML classifiers give a creator a number with no reason attached — not something you can act on when the email might also be a real paycheck.
The approach
The engine is five small stages: parse the email, run rules, score, report, and a CLI. Each rule is a pure function over the parsed message, grouped into auth, identity, links, attachments, and content, and each has a unit test against a real .eml fixture.
Scoring has two guardrails. Category caps stop one noisy dimension from dominating — six mismatched links can’t outrank an actual executable. Hard overrides force the top verdict for near-certain patterns, like a password-locked archive paired with a “download the brief” pretext. Optional enrichment adds RDAP domain age and URLhaus / OpenPhish lookups, and every enrichment fails safe to neutral: an outage never raises or lowers a score.
Measuring it
Detection quality is measured, not asserted. An evaluation harness reports precision and recall at each verdict band, a confusion matrix, and per-rule firing counts on scam versus genuine mail. False alarms and misses are reported separately, because telling a creator that a real offer is an attack is the worse error — so a CI gate holds genuine emails reaching Dangerous at zero. The seeded corpus is synthetic, and the project says so: those numbers show the engine works, not how it generalises.