isPhishingnoulPlayground
Is this email phishing?
Is this email phishing? A fake Apple notice is judged high risk; an internal company maintenance notice is judged low risk.
Request
stateemail
fromApple Support <no-reply@apple-id-verify.co>subjectURGENT: your Apple ID will be disabled in 24 hoursbodyUnusual sign-in detected. Enter your password and code here to keep your account: hxxp://apple-id-verify.co/login
Results
Sample dataCompare two examples
These two examples differ by one detail. The result changes with them.
What changedFake brand notice → internal maintenance mail
These results are sample data, not a live model run. Sign in to try them with your own content.
isPhishing: Confidence = 0.04 → Confidence = 0.97 tactic: none · Normal email → credentials · Credential request
tacticchoiceConfidence per option
Brand impersonation31%
Manufactured urgency22%
Credential request45%
Normal email2%
Copy the code
Set SYSTEM_ONE_API_KEY. The snippet uses a published catalog model id.
Request JSON
application/json
{"model":"decider-v1.1","state":{"from":"Apple Support <no-reply@apple-id-verify.co>","subject":"URGENT: your Apple ID will be disabled in 24 hours","body":"Unusual sign-in detected. Enter your password and code here to keep your account: hxxp://apple-id-verify.co/login"},"questions":{"isPhishing":{"type":"noul","instructions":"Is this email a phishing attempt?","criteria":{"true":"Tries to obtain account access, credentials or payment","false":"Ordinary business email"}},"tactic":{"type":"choice","instructions":"Which tactic does the email mainly use?","criteria":{"impersonation":"Brand impersonation","urgency":"Manufactured urgency","credentials":"Credential request","none":"Normal email"}}}}cURL · POST /v1/systemone
sh
curl "https://system-one.dev/v1/systemone" \ -H "Authorization: Bearer $SYSTEM_ONE_API_KEY" \ -H 'Content-Type: application/json' \ -H 'Idempotency-Key: saved-operation-id' \ --data '{"model":"decider-v1.1","state":{"from":"Apple Support <no-reply@apple-id-verify.co>","subject":"URGENT: your Apple ID will be disabled in 24 hours","body":"Unusual sign-in detected. Enter your password and code here to keep your account: hxxp://apple-id-verify.co/login"},"questions":{"isPhishing":{"type":"noul","instructions":"Is this email a phishing attempt?","criteria":{"true":"Tries to obtain account access, credentials or payment","false":"Ordinary business email"}},"tactic":{"type":"choice","instructions":"Which tactic does the email mainly use?","criteria":{"impersonation":"Brand impersonation","urgency":"Manufactured urgency","credentials":"Credential request","none":"Normal email"}}}}'TypeScript
TypeScript
// npm install @system-one-ai/core@0.6.0 @system-one-ai/transport-fetch@0.6.0 @system-one-ai/adapter-system-one@0.6.0import { createSystemOne, choice, score, booleanQuestion } from '@system-one-ai/core';import { systemOneAdapter } from '@system-one-ai/adapter-system-one';import { createFetchTransport } from '@system-one-ai/transport-fetch';const client = createSystemOne({ baseURL: "https://system-one.dev/v1", apiKey: process.env.SYSTEM_ONE_API_KEY!, model: "decider-v1.1", adapter: systemOneAdapter, transport: createFetchTransport(), timeoutMs: 30_000, maxRetries: 0,});const result = await client.evaluate({ state: { "from": "Apple Support <no-reply@apple-id-verify.co>", "subject": "URGENT: your Apple ID will be disabled in 24 hours", "body": "Unusual sign-in detected. Enter your password and code here to keep your account: hxxp://apple-id-verify.co/login" }, questions: { isPhishing: booleanQuestion("Is this email a phishing attempt?", { true: "Tries to obtain account access, credentials or payment", false: "Ordinary business email", }), tactic: choice("Which tactic does the email mainly use?", { impersonation: "Brand impersonation", urgency: "Manufactured urgency", credentials: "Credential request", none: "Normal email", }), },}, { headers: { 'Idempotency-Key': crypto.randomUUID() } });result.answers.isPhishing.probabilityresult.answers.tactic.choiceresult.response.requestId;