What pup checks
pup compares links with known malicious hosts and your server’s blocked hosts. It refreshes the public PhishDestroy feed and its allowlist every hour, and checks messages again when they are edited. Bare domains and links without a scheme, such asexample.com/login, are checked against known malicious hosts without opening the destination. Full HTTP(S) URLs and masked links also receive destination checks, following at most three redirects. Private network addresses are not opened. A failed lookup creates no phishing incident.