diff --git a/config/branding.json b/config/branding.json
index c09a76b..4a0cfdb 100644
--- a/config/branding.json
+++ b/config/branding.json
@@ -1,7 +1,9 @@
 {
   "companyName": "CyberDrain",
-  "companyURL": "https://cyberdrain.com/",
   "productName": "Check",
+  "supportUrl": "",
+  "privacyPolicyUrl": "",
+  "aboutUrl": "",
   "version": "1.1.0",
   "description": "Protect against phishing attacks targeting Microsoft 365 login pages with enterprise-grade detection",
   "branding": {
diff --git a/config/managed_schema.json b/config/managed_schema.json
index fa279af..057b641 100644
--- a/config/managed_schema.json
+++ b/config/managed_schema.json
@@ -125,12 +125,6 @@
           "description": "Company name to display in the extension",
           "type": "string",
           "default": ""
-        },
-		"companyURL": {
-          "title": "Company URL",
-          "description": "Company URL used in the extension",
-          "type": "string",
-          "default": "https://cyberdrain.com/"
         },
         "productName": {
           "title": "Product Name",
@@ -145,6 +139,27 @@
           "format": "email",
           "default": ""
         },
+        "supportUrl": {
+          "title": "Support URL",
+          "description": "URL opened by the popup Support link",
+          "type": "string",
+          "format": "uri",
+          "default": ""
+        },
+        "privacyPolicyUrl": {
+          "title": "Privacy URL",
+          "description": "URL opened by the popup Privacy link",
+          "type": "string",
+          "format": "uri",
+          "default": ""
+        },
+        "aboutUrl": {
+          "title": "About URL",
+          "description": "URL opened by the popup About link",
+          "type": "string",
+          "format": "uri",
+          "default": ""
+        },
         "primaryColor": {
           "title": "Primary Color",
           "description": "Primary theme color (hex code)",
@@ -160,6 +175,82 @@
           "default": ""
         }
       }
+    },
+    "domainSquatting": {
+      "title": "Domain Squatting Detection",
+      "description": "Configuration for domain squatting detection to protect against typosquatting, homoglyphs, and combosquatting attacks. Enable/disable is controlled here (config/policy), and domains are automatically extracted from the URL allowlist.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "title": "Enabled",
+          "description": "Enable or disable domain squatting detection",
+          "type": "boolean",
+          "default": true
+        },
+        "deviationThreshold": {
+          "title": "Deviation Threshold",
+          "description": "Maximum number of character differences (Levenshtein distance) to trigger detection. Lower values are stricter.",
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 5,
+          "default": 2
+        },
+        "algorithms": {
+          "title": "Detection Algorithms",
+          "description": "Enable or disable specific detection algorithms",
+          "type": "object",
+          "properties": {
+            "levenshtein": {
+              "title": "Levenshtein Distance",
+              "description": "Detect domains with small character differences",
+              "type": "boolean",
+              "default": true
+            },
+            "homoglyph": {
+              "title": "Homoglyph Detection",
+              "description": "Detect confusable characters (e.g., 'a' vs 'а')",
+              "type": "boolean",
+              "default": true
+            },
+            "typosquat": {
+              "title": "Typosquatting Detection",
+              "description": "Detect common typing mistakes and character swaps",
+              "type": "boolean",
+              "default": true
+            },
+            "combosquat": {
+              "title": "Combosquatting Detection",
+              "description": "Detect domains with added prefixes/suffixes",
+              "type": "boolean",
+              "default": true
+            }
+          }
+        },
+        "protectedDomains": {
+          "title": "Additional Protected Domains",
+          "description": "OPTIONAL: Additional domains to protect beyond those automatically extracted from the URL allowlist. Normally you should just add domains to the URL allowlist instead.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "title": "Domain",
+            "description": "Domain name to protect (e.g., 'company.com')"
+          },
+          "default": []
+        },
+        "Action": {
+          "title": "Action",
+          "description": "Action to take when domain squatting is detected",
+          "type": "string",
+          "enum": ["block", "warn", "log"],
+          "default": "block"
+        },
+        "logDetections": {
+          "title": "Log Detections",
+          "description": "Log all domain squatting detections to activity log",
+          "type": "boolean",
+          "default": true
+        }
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md
index 6023154..38ff855 100644
--- a/docs/SUMMARY.md
+++ b/docs/SUMMARY.md
@@ -3,6 +3,10 @@
 - [About](README.md)
 - [Firefox Support](firefox-support.md)
 
+## Features
+
+- [Domain Squatting Detection](features/domain-squatting-detection.md)
+
 ## Deployment
 
 - [Chrome/Edge Deployment Instructions](deployment/chrome-edge-deployment-instructions/README.md)
diff --git a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
index b4ce740..f26d209 100644
--- a/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
+++ b/docs/deployment/chrome-edge-deployment-instructions/windows/manual-deployment.md
@@ -10,6 +10,7 @@ This script is designed to deploy the extension to both Chrome and Edge. It is r
 
 1. Review the Extension Configuration Settings and Custom Branding Settings variables and update those to your desired values. The current values in the script are the default values. Leaving any unchanged will set the defaults.
 2. If you are leveraging a RMM that has the ability to define the variables in the deployment section of scripting, then you may be able to remove this section and enter the variable definitions into the RMM scripting pages.
+3. For webhook deployment, configure `$enableGenericWebhook`, `$webhookUrl`, and `$webhookEvents` in the script. Supported events are documented in [Webhook Documentation](../../../webhooks.md).
 
 <a href="https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/enterprise/Deploy-Windows-Chrome-and-Edge.ps1" class="button primary">Download the Script from GitHub</a>
 {% endtab %}
diff --git a/docs/features/domain-squatting-detection.md b/docs/features/domain-squatting-detection.md
new file mode 100644
index 0000000..d518f0c
--- /dev/null
+++ b/docs/features/domain-squatting-detection.md
@@ -0,0 +1,232 @@
+# Domain Squatting Detection
+
+Domain squatting protection helps keep you safe from fake websites that try to trick you by using look-alike domain names. Attackers create these fake domains to steal your login credentials.
+
+## What is Domain Squatting?
+
+Domain squatting (sometimes called "typosquatting") is when attackers register website addresses that are intentionally similar to legitimate sites. For example:
+
+- `micros0ft.com` (using a zero instead of the letter O)
+- `microsоft.com` (using a Cyrillic "о" that looks like an English "o")
+- `login-microsoft.com` (adding extra words to a real domain)
+
+These fake sites often look exactly like the real Microsoft login page, but they're designed to capture your username and password.
+
+## How Check Protects You
+
+Check automatically watches for these fake domains using four smart detection methods:
+
+### 1. **Character Difference Detection**
+Spots domains where characters are changed, missing, or swapped around.
+
+**Examples Check catches:**
+- `microsft.com` → missing the letter "o"
+- `micorsoft.com` → letters swapped ("or" instead of "ro")
+- `microosoft.com` → extra letter added
+
+### 2. **Look-Alike Character Detection**
+Finds domains using special characters that look similar to normal letters.
+
+**Examples Check catches:**
+- `micrоsoft.com` → uses a Cyrillic "о" that looks like an English "o"
+- `microsоft.com` → mixes different alphabet characters
+- `micro𝐬oft.com` → uses special Unicode characters
+
+### 3. **Typing Mistake Detection**
+Identifies domains based on common typing errors and keyboard slip-ups.
+
+**Examples Check catches:**
+- `micrisoft.com` → finger slipped to nearby key
+- `microssoft.com` → double-typed a letter
+- `microosft.com` → typo mixing up letters
+
+### 4. **Suspicious Word Combination Detection**
+Spots domains that add words before or after legitimate domains to look more official.
+
+**Examples Check catches:**
+- `secure-microsoft.com`
+- `login-microsoft-verify.com`
+- `microsoft-auth.com`
+- `official-microsoft-support.com`
+
+Common suspicious words attackers use: `login`, `secure`, `verify`, `official`, `support`, `auth`, `signin`, `portal`
+
+## What Domains Are Protected?
+
+Check protects **30+ popular domains** by default, including:
+
+**Microsoft Services:**
+- microsoft.com, microsoftonline.com, office.com, outlook.com, onedrive.com, and more
+
+**Other Popular Services:**
+- google.com, github.com, facebook.com, amazon.com, apple.com, paypal.com, and more
+
+**Plus: Your URL Allowlist**
+
+{% hint style="info" %}
+**Unified Protection:** Check uses your [URL Allowlist](../settings/detection-rules.md#url-allowlist-regex-or-url-with-wildcards) for double protection. Any domains you add there are automatically protected from squatting attempts too!
+
+For example, if you add `https://yourcompany.com/*` to your allowlist, Check will also protect against fake domains like `yourcompany.net` or `your-company.com`.
+{% endhint %}
+
+## How It Works in Practice
+
+When you visit a website, Check automatically:
+
+1. **Checks** if the domain looks similar to any protected domain
+2. **Analyzes** using all four detection methods
+3. **Warns** you if it finds a suspicious match
+4. **Blocks** the page if it's clearly a phishing attempt
+
+You don't need to do anything - the protection works automatically in the background!
+
+## Configuration
+
+{% hint style="warning" %}
+**For most users**: Domain squatting detection works automatically with default settings. You don't need to change anything!
+{% endhint %}
+
+### Page Blocking Control
+
+Check has an **"Enable Page Blocking"** setting in the extension options that controls how suspicious pages are handled:
+
+- **Page Blocking Enabled** + **Action: "block"** = Page is completely blocked with full-page warning
+- **Page Blocking Enabled** + **Action: "warn"** = Warning banner shown, page remains accessible
+- **Page Blocking Disabled** = Warning banner shown regardless of action setting (never blocks)
+
+This gives you control over whether you want aggressive blocking or just warnings for suspicious domains.
+
+### For Advanced Users and IT Departments
+
+Domain squatting detection is configured in your detection rules file (not in the Settings UI). This follows the same pattern as other advanced security features like Rogue Apps Detection.
+
+#### How to Configure
+
+Edit your `rules/detection-rules.json` file to customize:
+
+**Enable/Disable Detection:**
+```json
+{
+  "domain_squatting": {
+    "enabled": true,  // Turn detection on/off
+    "action": "block" // Action when detected: "block" or "warn"
+  }
+}
+```
+
+**Set Action Type:**
+```json
+{
+  "domain_squatting": {
+    "action": "block"  // "block" = full page block, "warn" = banner only
+  }
+}
+```
+Note: Page blocking also requires "Enable Page Blocking" to be turned ON in settings.
+
+**Adjust Sensitivity:**
+    "enabled": true
+  }
+}
+```
+
+**Adjust Sensitivity** (how strict the checking is):
+```json
+{
+  "domain_squatting": {
+    "deviation_threshold": 2
+  }
+}
+```
+- Lower numbers (1) = Very strict, catches fewer variations
+- Higher numbers (3-5) = More lenient, catches more variations
+- Default is 2 (recommended for most organizations)
+
+**Choose Detection Methods:**
+```json
+{
+  "domain_squatting": {
+    "algorithms": {
+      "levenshtein": true,
+      "homoglyph": true,
+      "typosquat": true,
+      "combosquat": true
+    }
+  }
+}
+```
+
+You can turn individual detection methods on/off. We recommend keeping all four enabled for maximum protection.
+
+## For MSPs and Enterprise IT
+
+### Enterprise Policy Management
+
+Domain squatting detection can be managed through Group Policy (GPO) or Microsoft Intune, just like other Check settings.
+
+**What You Can Control via Policy:**
+- Detection sensitivity (character difference threshold)
+- Which detection methods are active
+- Additional protected domains specific to your organization
+
+**What's in the Rules File:**
+- Enable/disable domain squatting detection
+- Default protected domains list
+- Detection rules and patterns
+
+This separation gives you flexibility - you control the core security settings through your detection rules file, while still allowing policy-based customization for different clients or departments.
+
+### Adding Organization-Specific Domains
+
+{% hint style="info" %}
+**Use the URL Allowlist!** 
+
+The easiest way to protect your organization's domains is to add them to the URL Allowlist in Detection Rules settings. This automatically:
+1. Prevents false positives on your internal sites
+2. Protects those domains from squatting attempts
+3. Works without modifying detection rules files
+{% endhint %}
+
+**Example:** Adding `https://contoso.com/*` to your allowlist protects against fake domains like:
+- `cont0so.com` (zero instead of o)
+- `contos0.com` (zero at the end)
+- `login-contoso.com` (suspicious prefix)
+
+### CIPP Reporting and Webhooks
+
+Domain squatting detections are automatically reported through your existing Check monitoring:
+
+- **Activity Logs**: View all domain squatting warnings and blocks
+- **CIPP Integration**: Squatting detections appear in your CIPP logbook
+- **Webhooks**: Configure webhooks to receive `domain_squatting_detected` events
+
+See [General Settings](../settings/general.md) for configuring reporting and webhooks.
+
+## Troubleshooting
+
+### "Check blocked a legitimate site"
+
+If Check blocks a site you trust:
+
+1. **Add it to your URL Allowlist** in Detection Rules settings
+2. The site will be both allowed and protected from squatting
+3. Report the false positive to help improve Check
+
+### "A phishing site wasn't detected"
+
+Domain squatting detection works alongside Check's other phishing protections. If a site gets through:
+
+1. Use "Report False Negative" if you encounter a phishing site
+2. Check will update rules to catch it in the future
+3. Your report helps protect the entire community
+
+### "Settings are grayed out"
+
+If you can't see or change domain squatting settings, your IT department has configured these centrally. This is normal for managed deployments - contact your IT team if you need adjustments.
+
+## Related Documentation
+
+- [Detection Rules](../settings/detection-rules.md) - Configure your URL allowlist
+- [General Settings](../settings/general.md) - Set up reporting and webhooks
+- [Enterprise Deployment](../deployment/) - Deploy Check across your organization
+- [Creating Detection Rules](../advanced/creating-detection-rules.md) - Advanced rule customization
diff --git a/docs/settings/branding.md b/docs/settings/branding.md
index a4dce7b..9ba3fed 100644
--- a/docs/settings/branding.md
+++ b/docs/settings/branding.md
@@ -30,9 +30,11 @@ If some settings do not appear on your version, it means your organization's IT
 You can customize the following properties:
 
 1. **Company Name** - Enter your organization's name. This appears in the extension interface and blocked page messages (displayed as "Protected by \[Company Name]").
-2. **Company URL** - Your company website URL (e.g., `https://yourcompany.com`). Used in extension branding and contact information. _(Firefox: required, Chrome/Edge: optional)_
-3. **Product Name** - What you want to call the extension (like "Contoso Security" instead of "Check"). This replaces the default "Check" branding throughout the interface.
-4. **Support Email** - Where users should go for help. This email address is used in the "Contact Admin" button when phishing sites are blocked.
+2. **Product Name** - What you want to call the extension (like "Contoso Security" instead of "Check"). This replaces the default "Check" branding throughout the interface.
+3. **Support Email** - Where users should go for help. This email address is used in the "Contact Admin" button when phishing sites are blocked.
+4. **Support URL** - URL opened by the popup **Support** link (for example, `https://support.yourcompany.com`).
+5. **Privacy Policy URL** (`privacyPolicyUrl`) - URL opened by the popup **Privacy** link (for example, `https://yourcompany.com/privacy`).
+6. **About URL** (`aboutUrl`) - URL opened by the popup **About** link. Leave empty to use the built-in extension About page.
 
 ## Visual Customization
 
@@ -60,6 +62,9 @@ The branding preview shows you exactly how your customizations will appear to us
    * Logo (upload or provide URL)
    * Primary Color
    * Support Email
+   * Support URL
+   * Privacy Policy URL
+   * About URL
 4. Click "Save"
 
 Your branding will be immediately applied to all components.
@@ -78,7 +83,10 @@ For enterprise deployments using Windows Group Policy:
     "companyName": "Your Company",
     "logoUrl": "https://example.com/logo.png",
     "primaryColor": "#FF5733",
-    "supportEmail": "security@example.com"
+    "supportEmail": "security@example.com",
+    "supportUrl": "https://support.example.com",
+    "privacyPolicyUrl": "https://example.com/privacy",
+    "aboutUrl": "https://example.com/about"
   }
 }
 ```
@@ -106,9 +114,11 @@ For Firefox deployments, configure branding through the `policies.json` file:
         "check@cyberdrain.com": {
           "customBranding": {
             "companyName": "Your Company",
-            "companyURL": "https://yourcompany.com",
             "productName": "Security Extension",
             "supportEmail": "security@example.com",
+            "supportUrl": "https://support.example.com",
+            "privacyPolicyUrl": "https://example.com/privacy",
+            "aboutUrl": "https://example.com/about",
             "primaryColor": "#FF5733",
             "logoUrl": "https://example.com/logo.png"
           }
@@ -137,7 +147,10 @@ For organizations using Microsoft Intune with Chrome/Edge:
     "companyName": "Your Company",
     "logoUrl": "https://example.com/logo.png",
     "primaryColor": "#FF5733",
-    "supportEmail": "security@example.com"
+    "supportEmail": "security@example.com",
+    "supportUrl": "https://support.example.com",
+    "privacyPolicyUrl": "https://example.com/privacy",
+    "aboutUrl": "https://example.com/about"
   }
 }
 ```
@@ -201,7 +214,6 @@ Enterprise policies always take precedence over manual settings.
 
 * Uses extension ID: `check@cyberdrain.com`
 * Configuration is managed through `policies.json` file
-* Supports additional `companyURL` property
 * Policies file location varies by operating system
 
 ### Chrome & Edge
@@ -290,7 +302,10 @@ Logo URL: https://assets.globalmfg.com/security/gmi-logo-48.png
     "productName": "Contoso Defender",
     "logoUrl": "https://contoso.com/assets/logo.png",
     "primaryColor": "#0078D4",
-    "supportEmail": "security@contoso.com"
+    "supportEmail": "security@contoso.com",
+    "supportUrl": "https://support.contoso.com",
+    "privacyPolicyUrl": "https://contoso.com/privacy",
+    "aboutUrl": "https://contoso.com/about"
   }
 }
 ```
@@ -305,11 +320,13 @@ Logo URL: https://assets.globalmfg.com/security/gmi-logo-48.png
         "check@cyberdrain.com": {
           "customBranding": {
             "companyName": "Contoso Corporation",
-            "companyURL": "https://contoso.com",
             "productName": "Contoso Defender",
             "logoUrl": "https://contoso.com/assets/logo.png",
             "primaryColor": "#0078D4",
-            "supportEmail": "security@contoso.com"
+            "supportEmail": "security@contoso.com",
+            "supportUrl": "https://support.contoso.com",
+            "privacyPolicyUrl": "https://contoso.com/privacy",
+            "aboutUrl": "https://contoso.com/about"
           }
         }
       }
diff --git a/docs/settings/detection-rules.md b/docs/settings/detection-rules.md
index 4f3c466..1babb7b 100644
--- a/docs/settings/detection-rules.md
+++ b/docs/settings/detection-rules.md
@@ -41,6 +41,14 @@ MSPs and IT departments commonly need to exclude phishing training platforms (li
 
 Add URLs or patterns that should be excluded from phishing detection. This is useful for internal company sites or trusted third-party services that might trigger false positives.
 
+**Dual Protection:** Your allowlist serves two purposes:
+1. **Prevents false positives** - Sites you add won't be flagged as phishing
+2. **Domain squatting protection** - Domains extracted from your allowlist are automatically protected against typosquatting and look-alike attacks
+
+For example, adding `https://yourcompany.com/*` will both allow that site AND protect against fake domains like `yourcompany.net`, `your-company.com`, or `y0urcompany.com`.
+
+Learn more about [Domain Squatting Detection](../features/domain-squatting-detection.md).
+
 **How it works:** Your allowlist patterns are **added to** (not replacing) the default CyberDrain exclusions, providing additional protection without losing baseline coverage.
 
 You can use:
diff --git a/enterprise/Check-Extension-Policy.reg b/enterprise/Check-Extension-Policy.reg
index fce2f70..3ac0464 100644
--- a/enterprise/Check-Extension-Policy.reg
+++ b/enterprise/Check-Extension-Policy.reg
@@ -20,11 +20,26 @@ Windows Registry Editor Version 5.00
 "updateInterval"=dword:00000018
 "enableDebugLogging"=dword:00000000
 
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\domainSquatting]
+"enabled"=dword:00000001
+
+; Generic webhook configuration (optional)
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook]
+"enabled"=dword:00000000
+"url"=""
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook\events]
+"1"="detection_alert"
+"2"="page_blocked"
+
 ; Custom branding configuration
 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding]
 "companyName"="CyberDrain"
 "productName"="Check"
 "supportEmail"=""
+"supportUrl"=""
+"privacyPolicyUrl"=""
+"aboutUrl"=""
 "primaryColor"="#F77F00"
 "logoUrl"=""
 
@@ -52,11 +67,26 @@ Windows Registry Editor Version 5.00
 "updateInterval"=dword:00000018
 "enableDebugLogging"=dword:00000000
 
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\domainSquatting]
+"enabled"=dword:00000001
+
+; Generic webhook configuration for Chrome (optional)
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook]
+"enabled"=dword:00000000
+"url"=""
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook\events]
+"1"="detection_alert"
+"2"="page_blocked"
+
 ; Custom branding configuration for Chrome
 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding]
 "companyName"="CyberDrain"
 "productName"="Check"
 "supportEmail"=""
+"supportUrl"=""
+"privacyPolicyUrl"=""
+"aboutUrl"=""
 "primaryColor"="#F77F00"
 "logoUrl"=""
 
diff --git a/enterprise/Deploy-Windows-Chrome-and-Edge.ps1 b/enterprise/Deploy-Windows-Chrome-and-Edge.ps1
index b886eb8..af90153 100644
--- a/enterprise/Deploy-Windows-Chrome-and-Edge.ps1
+++ b/enterprise/Deploy-Windows-Chrome-and-Edge.ps1
@@ -22,6 +22,7 @@ $cippTenantId = "" # This will set the "Tenant ID/Domain" option in the extensio
 $customRulesUrl = "" # This will set the "Config URL" option in the Detection Configuration settings; default is blank.
 $updateInterval = 24 # This will set the "Update Interval" option in the Detection Configuration settings; default is 24 (hours). Range: 1-168 hours (1 hour to 1 week).
 $urlAllowlist = @() # This will set the "URL Allowlist" option in the Detection Configuration settings; default is blank; if you want to add multiple URLs, add them as a comma-separated list within the brackets (e.g., @("https://example1.com", "https://example2.com")). Supports simple URLs with * wildcard (e.g., https://*.example.com) or advanced regex patterns (e.g., ^https:\/\/(www\.)?example\.com\/.*$).
+$domainSquattingEnabled = 1 # 0 = Disabled, 1 = Enabled; default is 1; controls domain squatting detection from managed policy/config.
 $enableDebugLogging = 0 # 0 = Unchecked, 1 = Checked (Enabled); default is 0; This will set the "Enable Debug Logging" option in the Activity Log settings.
 
 # Generic Webhook Settings
@@ -31,9 +32,11 @@ $webhookEvents = @() # This will set the "Event Types" to send to the webhook; d
 
 # Custom Branding Settings
 $companyName = "CyberDrain" # This will set the "Company Name" option in the Custom Branding settings; default is "CyberDrain".
-$companyURL = "https://cyberdrain.com" # This will set the Company URL option in the Custom Branding settings; default is "https://cyberdrain.com"; Must include the protocol (e.g., https://).
 $productName = "Check - Phishing Protection" # This will set the "Product Name" option in the Custom Branding settings; default is "Check - Phishing Protection".
 $supportEmail = "" # This will set the "Support Email" option in the Custom Branding settings; default is blank.
+$supportUrl = "" # This will set the "Support URL" option in the Custom Branding settings; default is blank.
+$privacyPolicyUrl = "" # This will set the "Privacy URL" option in the Custom Branding settings; default is blank.
+$aboutUrl = "" # This will set the "About URL" option in the Custom Branding settings; default is blank.
 $primaryColor = "#F77F00" # This will set the "Primary Color" option in the Custom Branding settings; default is "#F77F00"; must be a valid hex color code (e.g., #FFFFFF).
 $logoUrl = "" # This will set the "Logo URL" option in the Custom Branding settings; default is blank. Must be a valid URL including the protocol (e.g., https://example.com/logo.png); protocol must be https; recommended size is 48x48 pixels with a maximum of 128x128.
 
@@ -66,6 +69,13 @@ function Configure-ExtensionSettings {
     New-ItemProperty -Path $ManagedStorageKey -Name "updateInterval" -PropertyType DWord -Value $updateInterval -Force | Out-Null
     New-ItemProperty -Path $ManagedStorageKey -Name "enableDebugLogging" -PropertyType DWord -Value $enableDebugLogging -Force | Out-Null
 
+    # Create and configure domain squatting policy settings
+    $domainSquattingKey = "$ManagedStorageKey\domainSquatting"
+    if (!(Test-Path $domainSquattingKey)) {
+        New-Item -Path $domainSquattingKey -Force | Out-Null
+    }
+    New-ItemProperty -Path $domainSquattingKey -Name "enabled" -PropertyType DWord -Value $domainSquattingEnabled -Force | Out-Null
+
     # Create and configure URL allow list
     $urlAllowlistKey = "$ManagedStorageKey\urlAllowlist"
     if (!(Test-Path $urlAllowlistKey)) {
@@ -90,9 +100,11 @@ function Configure-ExtensionSettings {
 
     # Set custom branding settings
     New-ItemProperty -Path $customBrandingKey -Name "companyName" -PropertyType String -Value $companyName -Force | Out-Null
-    New-ItemProperty -Path $customBrandingKey -Name "companyURL" -PropertyType String -Value $companyURL -Force | Out-Null
     New-ItemProperty -Path $customBrandingKey -Name "productName" -PropertyType String -Value $productName -Force | Out-Null
     New-ItemProperty -Path $customBrandingKey -Name "supportEmail" -PropertyType String -Value $supportEmail -Force | Out-Null
+    New-ItemProperty -Path $customBrandingKey -Name "supportUrl" -PropertyType String -Value $supportUrl -Force | Out-Null
+    New-ItemProperty -Path $customBrandingKey -Name "privacyPolicyUrl" -PropertyType String -Value $privacyPolicyUrl -Force | Out-Null
+    New-ItemProperty -Path $customBrandingKey -Name "aboutUrl" -PropertyType String -Value $aboutUrl -Force | Out-Null
     New-ItemProperty -Path $customBrandingKey -Name "primaryColor" -PropertyType String -Value $primaryColor -Force | Out-Null
     New-ItemProperty -Path $customBrandingKey -Name "logoUrl" -PropertyType String -Value $logoUrl -Force | Out-Null
 
@@ -145,4 +157,4 @@ function Configure-ExtensionSettings {
 
 # Configure settings for Chrome and Edge
 Configure-ExtensionSettings -ExtensionId $chromeExtensionId -UpdateUrl $chromeUpdateUrl -ManagedStorageKey $chromeManagedStorageKey -ExtensionSettingsKey $chromeExtensionSettingsKey
-Configure-ExtensionSettings -ExtensionId $edgeExtensionId -UpdateUrl $edgeUpdateUrl -ManagedStorageKey $edgeManagedStorageKey -ExtensionSettingsKey $edgeExtensionSettingsKey
\ No newline at end of file
+Configure-ExtensionSettings -ExtensionId $edgeExtensionId -UpdateUrl $edgeUpdateUrl -ManagedStorageKey $edgeManagedStorageKey -ExtensionSettingsKey $edgeExtensionSettingsKey
diff --git a/enterprise/README.md b/enterprise/README.md
index 5ec8974..db3e4f1 100644
--- a/enterprise/README.md
+++ b/enterprise/README.md
@@ -26,8 +26,9 @@ This folder contains enterprise deployment resources for the Check Microsoft 365
 ## Quick Links
 
 - **Chrome/Edge Deployment**: See `Deploy-Windows-Chrome-and-Edge.ps1` for Windows, `macos-linux/` for macOS/Linux
-- **Firefox Deployment**: See `firefox/policies.json` template and [Firefox Deployment Guide](../docs/deployment/firefox-deployment.md)
-- **Configuration Schema**: See `../config/managed_schema.json` for all available settings
+- **Firefox Deployment**: See `firefox/policies.json` template and [Firefox Deployment Guide](../docs/deployment/firefox-deployment.md)
+- **Configuration Schema**: See `../config/managed_schema.json` for all available settings
+- **Webhook Configuration**: See `../docs/webhooks.md` for webhook payloads and supported event types
 
 ## Security Considerations
 
diff --git a/enterprise/Remove-Windows-Chrome-and-Edge.ps1 b/enterprise/Remove-Windows-Chrome-and-Edge.ps1
index fed3c9d..cad4445 100644
--- a/enterprise/Remove-Windows-Chrome-and-Edge.ps1
+++ b/enterprise/Remove-Windows-Chrome-and-Edge.ps1
@@ -58,14 +58,51 @@ function Remove-ExtensionSettings {
             }
         }
 
+        # Remove generic webhook subkey and event properties
+        $genericWebhookKey = "$ManagedStorageKey\genericWebhook"
+        if (Test-Path $genericWebhookKey) {
+            $webhookEventsKey = "$genericWebhookKey\events"
+            if (Test-Path $webhookEventsKey) {
+                $eventProperties = Get-ItemProperty -Path $webhookEventsKey -ErrorAction SilentlyContinue
+                if ($eventProperties) {
+                    $eventProperties.PSObject.Properties | Where-Object { $_.Name -match '^\d+$' } | ForEach-Object {
+                        Remove-ItemProperty -Path $webhookEventsKey -Name $_.Name -Force -ErrorAction SilentlyContinue
+                        Write-Host "Removed webhook event property: $($_.Name) from $webhookEventsKey"
+                    }
+                }
+                try {
+                    Remove-Item -Path $webhookEventsKey -Force -ErrorAction SilentlyContinue
+                    Write-Host "Removed webhook events subkey: $webhookEventsKey"
+                } catch {
+                    # Key may not be empty or may have been removed already
+                }
+            }
+
+            foreach ($property in @("enabled", "url")) {
+                if (Get-ItemProperty -Path $genericWebhookKey -Name $property -ErrorAction SilentlyContinue) {
+                    Remove-ItemProperty -Path $genericWebhookKey -Name $property -Force -ErrorAction SilentlyContinue
+                    Write-Host "Removed generic webhook property: $property from $genericWebhookKey"
+                }
+            }
+
+            try {
+                Remove-Item -Path $genericWebhookKey -Force -ErrorAction SilentlyContinue
+                Write-Host "Removed generic webhook subkey: $genericWebhookKey"
+            } catch {
+                # Key may not be empty or may have been removed already
+            }
+        }
+
         # Remove custom branding subkey and all its properties
         $customBrandingKey = "$ManagedStorageKey\customBranding"
         if (Test-Path $customBrandingKey) {
             $brandingPropertiesToRemove = @(
                 "companyName",
-                "companyURL",
                 "productName",
                 "supportEmail",
+                "supportUrl",
+                "privacyPolicyUrl",
+                "aboutUrl",
                 "primaryColor",
                 "logoUrl"
             )
diff --git a/enterprise/Test-Extension-Policy.ps1 b/enterprise/Test-Extension-Policy.ps1
index 6a07d23..79c60ec 100644
--- a/enterprise/Test-Extension-Policy.ps1
+++ b/enterprise/Test-Extension-Policy.ps1
@@ -23,16 +23,25 @@ $testConfig = @{
   enableDebugLogging = 1
 }
 
+$testDomainSquatting = @{
+  enabled = 1
+}
+
 # Custom branding test values
 $testBranding = @{
   companyName = "Test Company"
-  companyURL = "https://example.com"
   productName = "Test Product"
   supportEmail = "test@example.com"
   primaryColor = "#FF6B00"
   logoUrl = ""
 }
 
+$testGenericWebhook = @{
+  enabled = 0
+  url = ""
+  events = @("detection_alert", "page_blocked")
+}
+
 function Set-TestPolicies {
   param([string]$PolicyKey)
   
@@ -46,6 +55,12 @@ function Set-TestPolicies {
     $type = if ($value -is [int]) { "DWord" } else { "String" }
     New-ItemProperty -Path $PolicyKey -Name $key -PropertyType $type -Value $value -Force | Out-Null
   }
+
+  $domainSquattingKey = "$PolicyKey\domainSquatting"
+  if (!(Test-Path $domainSquattingKey)) {
+    New-Item -Path $domainSquattingKey -Force | Out-Null
+  }
+  New-ItemProperty -Path $domainSquattingKey -Name "enabled" -PropertyType DWord -Value $testDomainSquatting.enabled -Force | Out-Null
   
   $brandingKey = "$PolicyKey\customBranding"
   if (!(Test-Path $brandingKey)) {
@@ -55,6 +70,22 @@ function Set-TestPolicies {
   foreach ($key in $testBranding.Keys) {
     New-ItemProperty -Path $brandingKey -Name $key -PropertyType String -Value $testBranding[$key] -Force | Out-Null
   }
+
+  $genericWebhookKey = "$PolicyKey\genericWebhook"
+  if (!(Test-Path $genericWebhookKey)) {
+    New-Item -Path $genericWebhookKey -Force | Out-Null
+  }
+  New-ItemProperty -Path $genericWebhookKey -Name "enabled" -PropertyType DWord -Value $testGenericWebhook.enabled -Force | Out-Null
+  New-ItemProperty -Path $genericWebhookKey -Name "url" -PropertyType String -Value $testGenericWebhook.url -Force | Out-Null
+
+  $webhookEventsKey = "$genericWebhookKey\events"
+  if (!(Test-Path $webhookEventsKey)) {
+    New-Item -Path $webhookEventsKey -Force | Out-Null
+  }
+  Remove-ItemProperty -Path $webhookEventsKey -Name * -Force -ErrorAction SilentlyContinue | Out-Null
+  for ($i = 0; $i -lt $testGenericWebhook.events.Count; $i++) {
+    New-ItemProperty -Path $webhookEventsKey -Name ($i + 1) -PropertyType String -Value $testGenericWebhook.events[$i] -Force | Out-Null
+  }
   
   Write-Output "Applied test policies to: $PolicyKey"
 }
@@ -71,6 +102,18 @@ function Show-CurrentPolicies {
       Write-Output "`nCustom Branding:"
       Get-ItemProperty -Path $brandingKey | Format-List
     }
+
+    $genericWebhookKey = "$PolicyKey\genericWebhook"
+    if (Test-Path $genericWebhookKey) {
+      Write-Output "`nGeneric Webhook:"
+      Get-ItemProperty -Path $genericWebhookKey | Format-List
+    }
+
+    $domainSquattingKey = "$PolicyKey\domainSquatting"
+    if (Test-Path $domainSquattingKey) {
+      Write-Output "`nDomain Squatting:"
+      Get-ItemProperty -Path $domainSquattingKey | Format-List
+    }
   } else {
     Write-Output "No policies set at: $PolicyKey"
   }
diff --git a/enterprise/admx/Check-Extension.admx b/enterprise/admx/Check-Extension.admx
index d69c262..2918bd2 100644
--- a/enterprise/admx/Check-Extension.admx
+++ b/enterprise/admx/Check-Extension.admx
@@ -122,6 +122,36 @@
       </elements>
     </policy>
 
+    <!-- Generic Webhook Enabled -->
+    <policy name="CheckGenericWebhookEnabled" class="Machine" displayName="$(string.CheckGenericWebhookEnabled)" explainText="$(string.CheckGenericWebhookEnabled_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook" valueName="enabled">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
+
+    <!-- Generic Webhook URL -->
+    <policy name="CheckGenericWebhookUrl" class="Machine" displayName="$(string.CheckGenericWebhookUrl)" explainText="$(string.CheckGenericWebhookUrl_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook" presentation="$(presentation.CheckGenericWebhookUrl)">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="GenericWebhookUrl" valueName="url" />
+      </elements>
+    </policy>
+
+    <!-- Generic Webhook Events -->
+    <policy name="CheckGenericWebhookEvents" class="Machine" displayName="$(string.CheckGenericWebhookEvents)" explainText="$(string.CheckGenericWebhookEvents_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\genericWebhook\events" presentation="$(presentation.CheckGenericWebhookEvents)">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <list id="GenericWebhookEventsList" valueName="events" valuePrefix="" />
+      </elements>
+    </policy>
+
     <!-- Custom Rules URL -->
     <policy name="CheckCustomRulesUrl" class="Machine" displayName="$(string.CheckCustomRulesUrl)" explainText="$(string.CheckCustomRulesUrl_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy" presentation="$(presentation.CheckCustomRulesUrl)">
       <parentCategory ref="CheckExtensionEdge" />
@@ -176,6 +206,33 @@
       </elements>
     </policy>
 
+    <!-- Support URL -->
+    <policy name="CheckSupportUrl" class="Machine" displayName="$(string.CheckSupportUrl)" explainText="$(string.CheckSupportUrl_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding" presentation="$(presentation.CheckSupportUrl)">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="SupportUrl" valueName="supportUrl" />
+      </elements>
+    </policy>
+
+    <!-- Privacy URL -->
+    <policy name="CheckPrivacyPolicyUrl" class="Machine" displayName="$(string.CheckPrivacyPolicyUrl)" explainText="$(string.CheckPrivacyPolicyUrl_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding" presentation="$(presentation.CheckPrivacyPolicyUrl)">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="PrivacyPolicyUrl" valueName="privacyPolicyUrl" />
+      </elements>
+    </policy>
+
+    <!-- About URL -->
+    <policy name="CheckAboutUrl" class="Machine" displayName="$(string.CheckAboutUrl)" explainText="$(string.CheckAboutUrl_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding" presentation="$(presentation.CheckAboutUrl)">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="AboutUrl" valueName="aboutUrl" />
+      </elements>
+    </policy>
+
     <!-- Primary Color -->
     <policy name="CheckPrimaryColor" class="Machine" displayName="$(string.CheckPrimaryColor)" explainText="$(string.CheckPrimaryColor_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\customBranding" presentation="$(presentation.CheckPrimaryColor)">
       <parentCategory ref="CheckExtensionEdge" />
@@ -206,6 +263,18 @@
       </disabledValue>
     </policy>
 
+    <!-- Enable Domain Squatting Detection -->
+    <policy name="CheckDomainSquattingEnabled" class="Machine" displayName="$(string.CheckDomainSquattingEnabled)" explainText="$(string.CheckDomainSquattingEnabled_Explain)" key="SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\knepjpocdagponkonnbggpcnhnaikajg\policy\domainSquatting" valueName="enabled">
+      <parentCategory ref="CheckExtensionEdge" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
+
     <!-- CHROME EXTENSION POLICIES -->
 
     <!-- Extension Settings - Chrome -->
@@ -306,6 +375,36 @@
       </elements>
     </policy>
 
+    <!-- Generic Webhook Enabled - Chrome -->
+    <policy name="CheckGenericWebhookEnabledChrome" class="Machine" displayName="$(string.CheckGenericWebhookEnabledChrome)" explainText="$(string.CheckGenericWebhookEnabledChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook" valueName="enabled">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
+
+    <!-- Generic Webhook URL - Chrome -->
+    <policy name="CheckGenericWebhookUrlChrome" class="Machine" displayName="$(string.CheckGenericWebhookUrlChrome)" explainText="$(string.CheckGenericWebhookUrlChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook" presentation="$(presentation.CheckGenericWebhookUrlChrome)">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="GenericWebhookUrlChrome" valueName="url" />
+      </elements>
+    </policy>
+
+    <!-- Generic Webhook Events - Chrome -->
+    <policy name="CheckGenericWebhookEventsChrome" class="Machine" displayName="$(string.CheckGenericWebhookEventsChrome)" explainText="$(string.CheckGenericWebhookEventsChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\genericWebhook\events" presentation="$(presentation.CheckGenericWebhookEventsChrome)">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <list id="GenericWebhookEventsListChrome" valueName="events" valuePrefix="" />
+      </elements>
+    </policy>
+
     <!-- Custom Rules URL - Chrome -->
     <policy name="CheckCustomRulesUrlChrome" class="Machine" displayName="$(string.CheckCustomRulesUrlChrome)" explainText="$(string.CheckCustomRulesUrlChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy" presentation="$(presentation.CheckCustomRulesUrlChrome)">
       <parentCategory ref="CheckExtensionChrome" />
@@ -360,6 +459,33 @@
       </elements>
     </policy>
 
+    <!-- Support URL - Chrome -->
+    <policy name="CheckSupportUrlChrome" class="Machine" displayName="$(string.CheckSupportUrlChrome)" explainText="$(string.CheckSupportUrlChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding" presentation="$(presentation.CheckSupportUrlChrome)">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="SupportUrlChrome" valueName="supportUrl" />
+      </elements>
+    </policy>
+
+    <!-- Privacy URL - Chrome -->
+    <policy name="CheckPrivacyPolicyUrlChrome" class="Machine" displayName="$(string.CheckPrivacyPolicyUrlChrome)" explainText="$(string.CheckPrivacyPolicyUrlChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding" presentation="$(presentation.CheckPrivacyPolicyUrlChrome)">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="PrivacyPolicyUrlChrome" valueName="privacyPolicyUrl" />
+      </elements>
+    </policy>
+
+    <!-- About URL - Chrome -->
+    <policy name="CheckAboutUrlChrome" class="Machine" displayName="$(string.CheckAboutUrlChrome)" explainText="$(string.CheckAboutUrlChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding" presentation="$(presentation.CheckAboutUrlChrome)">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <elements>
+        <text id="AboutUrlChrome" valueName="aboutUrl" />
+      </elements>
+    </policy>
+
     <!-- Primary Color - Chrome -->
     <policy name="CheckPrimaryColorChrome" class="Machine" displayName="$(string.CheckPrimaryColorChrome)" explainText="$(string.CheckPrimaryColorChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\customBranding" presentation="$(presentation.CheckPrimaryColorChrome)">
       <parentCategory ref="CheckExtensionChrome" />
@@ -389,6 +515,18 @@
         <decimal value="0" />
       </disabledValue>
     </policy>
+
+    <!-- Enable Domain Squatting Detection - Chrome -->
+    <policy name="CheckDomainSquattingEnabledChrome" class="Machine" displayName="$(string.CheckDomainSquattingEnabledChrome)" explainText="$(string.CheckDomainSquattingEnabledChrome_Explain)" key="SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\benimdeioplgkhanklclahllklceahbe\policy\domainSquatting" valueName="enabled">
+      <parentCategory ref="CheckExtensionChrome" />
+      <supportedOn ref="SUPPORTED_WIN7" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
   </policies>
 </policyDefinitions>
 
diff --git a/enterprise/admx/en-US/Check-Extension.adml b/enterprise/admx/en-US/Check-Extension.adml
index 078a8c1..af97141 100644
--- a/enterprise/admx/en-US/Check-Extension.adml
+++ b/enterprise/admx/en-US/Check-Extension.adml
@@ -115,6 +115,36 @@
                 
                 This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
             </string>
+            <!-- Generic Webhook - Edge -->
+            <string id="CheckGenericWebhookEnabled">Enable generic webhook</string>
+            <string id="CheckGenericWebhookEnabled_Explain">
+                This policy controls whether the Check extension sends selected security events to a custom webhook endpoint.
+                
+                When enabled: Events listed in "Generic webhook event types" are sent to the configured Generic Webhook URL.
+                When disabled (default): No generic webhook events are sent.
+                
+                Note: Requires Generic Webhook URL and at least one event type.
+            </string>
+            <string id="CheckGenericWebhookUrl">Generic webhook URL</string>
+            <string id="CheckGenericWebhookUrl_Explain">
+                This policy specifies the URL for a custom webhook endpoint that receives Check event payloads.
+                
+                Example: https://webhook.yourcompany.com/check-events
+                
+                This setting is only used when generic webhook is enabled.
+            </string>
+            <string id="CheckGenericWebhookEvents">Generic webhook event types</string>
+            <string id="CheckGenericWebhookEvents_Explain">
+                This policy specifies which event types are sent to the generic webhook endpoint.
+                
+                Supported values:
+                - detection_alert
+                - false_positive_report
+                - page_blocked
+                - rogue_app_detected
+                - threat_detected
+                - validation_event
+            </string>
             <!-- Custom Rules URL -->
             <string id="CheckCustomRulesUrl">Custom detection rules URL</string>
             <string id="CheckCustomRulesUrl_Explain">
@@ -181,15 +211,6 @@
                 
                 The company name appears in the extension popup and settings pages.
             </string>
-            <!-- Company URL -->
-            <string id="CheckCompanyUrl">Company URL</string>
-            <string id="CheckCompanyUrl_Explain">
-                This policy specifies the company URL used in the extension for branding and navigation purposes.
-                
-                Example: https://contoso.com
-                
-                The company URL is used for linking back to the company website from the extension interface.
-            </string>
             <!-- Product Name -->
             <string id="CheckProductName">Product name</string>
             <string id="CheckProductName_Explain">
@@ -208,6 +229,27 @@
                 
                 This email address is displayed in the extension interface and help documentation.
             </string>
+            <!-- Support URL -->
+            <string id="CheckSupportUrl">Support URL</string>
+            <string id="CheckSupportUrl_Explain">
+                This policy specifies the support URL opened by the extension Support link.
+                
+                Example: https://support.contoso.com
+            </string>
+            <!-- Privacy URL -->
+            <string id="CheckPrivacyPolicyUrl">Privacy URL</string>
+            <string id="CheckPrivacyPolicyUrl_Explain">
+                This policy specifies the privacy policy URL opened by the extension Privacy link.
+                
+                Example: https://contoso.com/privacy
+            </string>
+            <!-- About URL -->
+            <string id="CheckAboutUrl">About URL</string>
+            <string id="CheckAboutUrl_Explain">
+                This policy specifies the about URL opened by the extension About link.
+                
+                Example: https://contoso.com/about
+            </string>
             <!-- Primary Color -->
             <string id="CheckPrimaryColor">Primary theme color</string>
             <string id="CheckPrimaryColor_Explain">
@@ -236,6 +278,13 @@
                 
                 Debug logging should only be enabled for troubleshooting as it may impact performance and generate large log files.
             </string>
+            <string id="CheckDomainSquattingEnabled">Enable domain squatting detection</string>
+            <string id="CheckDomainSquattingEnabled_Explain">
+                This policy controls domain squatting detection in the Check extension.
+
+                When enabled (default): Typosquatting, homoglyph, and combosquatting protections are active.
+                When disabled: Domain squatting detections are skipped.
+            </string>
             <!-- Debug Logging - Chrome -->
             <string id="CheckDebugLoggingChrome">Enable debug logging (Chrome)</string>
             <string id="CheckDebugLoggingChrome_Explain">
@@ -246,6 +295,13 @@
                 
                 Debug logging should only be enabled for troubleshooting as it may impact performance and generate large log files.
             </string>
+            <string id="CheckDomainSquattingEnabledChrome">Enable domain squatting detection (Chrome)</string>
+            <string id="CheckDomainSquattingEnabledChrome_Explain">
+                This policy controls domain squatting detection in the Check extension for Google Chrome.
+
+                When enabled (default): Typosquatting, homoglyph, and combosquatting protections are active.
+                When disabled: Domain squatting detections are skipped.
+            </string>
             <!-- Valid Page Badge - Chrome -->
             <string id="CheckValidPageBadgeChrome">Show valid page badge (Chrome)</string>
             <string id="CheckValidPageBadgeChrome_Explain">
@@ -300,6 +356,36 @@
                 
                 This helps identify which tenant/organization the security event originated from when using a shared CIPP instance.
             </string>
+            <!-- Generic Webhook - Chrome -->
+            <string id="CheckGenericWebhookEnabledChrome">Enable generic webhook (Chrome)</string>
+            <string id="CheckGenericWebhookEnabledChrome_Explain">
+                This policy controls whether the Check extension sends selected security events to a custom webhook endpoint in Google Chrome.
+                
+                When enabled: Events listed in "Generic webhook event types (Chrome)" are sent to the configured Generic Webhook URL.
+                When disabled (default): No generic webhook events are sent.
+                
+                Note: Requires Generic Webhook URL and at least one event type.
+            </string>
+            <string id="CheckGenericWebhookUrlChrome">Generic webhook URL (Chrome)</string>
+            <string id="CheckGenericWebhookUrlChrome_Explain">
+                This policy specifies the URL for a custom webhook endpoint that receives Check event payloads from Google Chrome.
+                
+                Example: https://webhook.yourcompany.com/check-events
+                
+                This setting is only used when generic webhook is enabled.
+            </string>
+            <string id="CheckGenericWebhookEventsChrome">Generic webhook event types (Chrome)</string>
+            <string id="CheckGenericWebhookEventsChrome_Explain">
+                This policy specifies which event types are sent to the generic webhook endpoint from Google Chrome.
+                
+                Supported values:
+                - detection_alert
+                - false_positive_report
+                - page_blocked
+                - rogue_app_detected
+                - threat_detected
+                - validation_event
+            </string>
             <!-- Custom Rules URL - Chrome -->
             <string id="CheckCustomRulesUrlChrome">Custom detection rules URL (Chrome)</string>
             <string id="CheckCustomRulesUrlChrome_Explain">
@@ -330,15 +416,6 @@
                 
                 The company name appears in the extension popup and settings pages.
             </string>
-            <!-- Company URL - Chrome -->
-            <string id="CheckCompanyUrlChrome">Company URL (Chrome)</string>
-            <string id="CheckCompanyUrlChrome_Explain">
-                This policy specifies the company URL used in the extension for branding and navigation purposes in Google Chrome.
-                
-                Example: https://contoso.com
-                
-                The company URL is used for linking back to the company website from the extension interface.
-            </string>
             <!-- Product Name - Chrome -->
             <string id="CheckProductNameChrome">Product name (Chrome)</string>
             <string id="CheckProductNameChrome_Explain">
@@ -357,6 +434,27 @@
                 
                 This email address is displayed in the extension interface and help documentation.
             </string>
+            <!-- Support URL - Chrome -->
+            <string id="CheckSupportUrlChrome">Support URL (Chrome)</string>
+            <string id="CheckSupportUrlChrome_Explain">
+                This policy specifies the support URL opened by the extension Support link in Google Chrome.
+                
+                Example: https://support.contoso.com
+            </string>
+            <!-- Privacy URL - Chrome -->
+            <string id="CheckPrivacyPolicyUrlChrome">Privacy URL (Chrome)</string>
+            <string id="CheckPrivacyPolicyUrlChrome_Explain">
+                This policy specifies the privacy policy URL opened by the extension Privacy link in Google Chrome.
+                
+                Example: https://contoso.com/privacy
+            </string>
+            <!-- About URL - Chrome -->
+            <string id="CheckAboutUrlChrome">About URL (Chrome)</string>
+            <string id="CheckAboutUrlChrome_Explain">
+                This policy specifies the about URL opened by the extension About link in Google Chrome.
+                
+                Example: https://contoso.com/about
+            </string>
             <!-- Primary Color - Chrome -->
             <string id="CheckPrimaryColorChrome">Primary theme color (Chrome)</string>
             <string id="CheckPrimaryColorChrome_Explain">
@@ -387,6 +485,14 @@
                     <label>Tenant Identifier:</label>
                 </textBox>
             </presentation>
+            <presentation id="CheckGenericWebhookUrl">
+                <textBox refId="GenericWebhookUrl">
+                    <label>Generic Webhook URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckGenericWebhookEvents">
+                <listBox refId="GenericWebhookEventsList">Generic Webhook Event Types:</listBox>
+            </presentation>
             <presentation id="CheckCustomRulesUrl">
                 <textBox refId="CustomRulesUrl">
                     <label>Custom Rules URL:</label>
@@ -409,11 +515,6 @@
                     <label>Company Name:</label>
                 </textBox>
             </presentation>
-            <presentation id="CheckCompanyUrl">
-                <textBox refId="CompanyUrl">
-                    <label>Company URL:</label>
-                </textBox>
-            </presentation>
             <presentation id="CheckProductName">
                 <textBox refId="ProductName">
                     <label>Product Name:</label>
@@ -424,6 +525,21 @@
                     <label>Support Email:</label>
                 </textBox>
             </presentation>
+            <presentation id="CheckSupportUrl">
+                <textBox refId="SupportUrl">
+                    <label>Support URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckPrivacyPolicyUrl">
+                <textBox refId="PrivacyPolicyUrl">
+                    <label>Privacy URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckAboutUrl">
+                <textBox refId="AboutUrl">
+                    <label>About URL:</label>
+                </textBox>
+            </presentation>
             <presentation id="CheckPrimaryColor">
                 <textBox refId="PrimaryColor">
                     <label>Primary Color (hex code):</label>
@@ -444,6 +560,14 @@
                     <label>Tenant Identifier:</label>
                 </textBox>
             </presentation>
+            <presentation id="CheckGenericWebhookUrlChrome">
+                <textBox refId="GenericWebhookUrlChrome">
+                    <label>Generic Webhook URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckGenericWebhookEventsChrome">
+                <listBox refId="GenericWebhookEventsListChrome">Generic Webhook Event Types:</listBox>
+            </presentation>
             <presentation id="CheckCustomRulesUrlChrome">
                 <textBox refId="CustomRulesUrlChrome">
                     <label>Custom Rules URL:</label>
@@ -458,11 +582,6 @@
                     <label>Company Name:</label>
                 </textBox>
             </presentation>
-            <presentation id="CheckCompanyUrlChrome">
-                <textBox refId="CompanyUrlChrome">
-                    <label>Company URL:</label>
-                </textBox>
-            </presentation>
             <presentation id="CheckProductNameChrome">
                 <textBox refId="ProductNameChrome">
                     <label>Product Name:</label>
@@ -473,6 +592,21 @@
                     <label>Support Email:</label>
                 </textBox>
             </presentation>
+            <presentation id="CheckSupportUrlChrome">
+                <textBox refId="SupportUrlChrome">
+                    <label>Support URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckPrivacyPolicyUrlChrome">
+                <textBox refId="PrivacyPolicyUrlChrome">
+                    <label>Privacy URL:</label>
+                </textBox>
+            </presentation>
+            <presentation id="CheckAboutUrlChrome">
+                <textBox refId="AboutUrlChrome">
+                    <label>About URL:</label>
+                </textBox>
+            </presentation>
             <presentation id="CheckPrimaryColorChrome">
                 <textBox refId="PrimaryColorChrome">
                     <label>Primary Color (hex code):</label>
@@ -491,4 +625,4 @@
             </presentation>
         </presentationTable>
     </resources>
-</policyDefinitionResources>
\ No newline at end of file
+</policyDefinitionResources>
diff --git a/enterprise/firefox/policies.json b/enterprise/firefox/policies.json
index be564a9..bb6a250 100644
--- a/enterprise/firefox/policies.json
+++ b/enterprise/firefox/policies.json
@@ -28,12 +28,17 @@
           "customRulesUrl": "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json",
           "updateInterval": 24,
           "urlAllowlist": [],
+          "domainSquatting": {
+            "enabled": true
+          },
           "enableDebugLogging": false,
           "customBranding": {
             "companyName": "",
-            "companyURL": "https://cyberdrain.com/",
             "productName": "",
             "supportEmail": "",
+            "supportUrl": "",
+            "privacyPolicyUrl": "",
+            "aboutUrl": "",
             "primaryColor": "#F77F00",
             "logoUrl": ""
           },
@@ -50,4 +55,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/enterprise/macos-linux/README.md b/enterprise/macos-linux/README.md
index 8e1d55a..fc9509b 100644
--- a/enterprise/macos-linux/README.md
+++ b/enterprise/macos-linux/README.md
@@ -158,9 +158,15 @@ All settings are based on the managed schema and include:
 - **`cippServerUrl`** - CIPP server URL for reporting
 - **`cippTenantId`** - Tenant identifier for multi-tenant environments
 
+### Generic Webhook Integration
+- **`genericWebhook.enabled`** - Enable sending events to custom webhook endpoint
+- **`genericWebhook.url`** - Webhook endpoint URL
+- **`genericWebhook.events`** - Event types to send (`detection_alert`, `false_positive_report`, `page_blocked`, `rogue_app_detected`, `threat_detected`, `validation_event`)
+
 ### Rule Management
 - **`customRulesUrl`** - URL for custom detection rules
 - **`updateInterval`** - Rule update interval in hours (default: 24)
+- **`domainSquatting.enabled`** - Enable/disable domain squatting detection (default: true)
 
 ### Custom Branding
 - **`companyName`** - Company name for white labeling
@@ -260,10 +266,11 @@ ls -la /etc/microsoft-edge/policies/managed/
 
 Before deployment, edit the JSON files to customize:
 1. **CIPP Integration** - Set `cippServerUrl` and `cippTenantId`
-2. **Custom Rules** - Set `customRulesUrl` to your rules endpoint
-3. **Branding** - Configure company name, colors, and logo URL
-4. **Security Settings** - Adjust notification and blocking preferences
-5. **Debug Mode** - Enable `enableDebugLogging` for troubleshooting
+2. **Webhook Integration** - Configure `genericWebhook.enabled`, `genericWebhook.url`, and `genericWebhook.events`
+3. **Custom Rules** - Set `customRulesUrl` to your rules endpoint
+4. **Branding** - Configure company name, colors, and logo URL
+5. **Security Settings** - Adjust notification and blocking preferences
+6. **Debug Mode** - Enable `enableDebugLogging` for troubleshooting
 
 ## Security Considerations
 
diff --git a/enterprise/macos-linux/check-extension-config.mobileconfig b/enterprise/macos-linux/check-extension-config.mobileconfig
index c3b77bb..e87ff3d 100644
--- a/enterprise/macos-linux/check-extension-config.mobileconfig
+++ b/enterprise/macos-linux/check-extension-config.mobileconfig
@@ -46,6 +46,18 @@
                     <key>Value</key>
                     <string />
                 </dict>
+                <key>genericWebhook</key>
+                <dict>
+                    <key>Value</key>
+                    <dict>
+                        <key>enabled</key>
+                        <false />
+                        <key>url</key>
+                        <string />
+                        <key>events</key>
+                        <array />
+                    </dict>
+                </dict>
                 <key>customRulesUrl</key>
                 <dict>
                     <key>Value</key>
@@ -56,6 +68,14 @@
                     <key>Value</key>
                     <integer>24</integer>
                 </dict>
+                <key>domainSquatting</key>
+                <dict>
+                    <key>Value</key>
+                    <dict>
+                        <key>enabled</key>
+                        <true />
+                    </dict>
+                </dict>
                 <!-- Logging Settings -->
                 <key>enableDebugLogging</key>
                 <dict>
@@ -102,4 +122,4 @@
         <key>TargetDeviceType</key>
         <integer>5</integer>
     </dict>
-</plist>
\ No newline at end of file
+</plist>
diff --git a/enterprise/macos-linux/chrome-managed-policy.json b/enterprise/macos-linux/chrome-managed-policy.json
index 58ac0eb..9890c57 100644
--- a/enterprise/macos-linux/chrome-managed-policy.json
+++ b/enterprise/macos-linux/chrome-managed-policy.json
@@ -18,10 +18,16 @@
                 "customRulesUrl": "",
                 "updateInterval": 24,
                 "enableDebugLogging": false,
+                "domainSquatting": {
+                    "enabled": true
+                },
                 "customBranding": {
                     "companyName": "",
                     "productName": "",
                     "supportEmail": "",
+                    "supportUrl": "",
+                    "privacyPolicyUrl": "",
+                    "aboutUrl": "",
                     "primaryColor": "#F77F00",
                     "logoUrl": ""
                 },
@@ -37,4 +43,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/enterprise/macos-linux/deploy-extension-prefs.sh b/enterprise/macos-linux/deploy-extension-prefs.sh
index 65b2b45..2f76344 100644
--- a/enterprise/macos-linux/deploy-extension-prefs.sh
+++ b/enterprise/macos-linux/deploy-extension-prefs.sh
@@ -71,6 +71,15 @@ create_extension_preferences() {
     <string></string>
     <key>cippTenantId</key>
     <string></string>
+    <key>genericWebhook</key>
+    <dict>
+        <key>enabled</key>
+        <false/>
+        <key>url</key>
+        <string></string>
+        <key>events</key>
+        <array/>
+    </dict>
     <key>customRulesUrl</key>
     <string>$custom_rules_url</string>
     <key>updateInterval</key>
@@ -211,4 +220,4 @@ main() {
     esac
 }
 
-main "$@"
\ No newline at end of file
+main "$@"
diff --git a/enterprise/macos-linux/edge-managed-policy.json b/enterprise/macos-linux/edge-managed-policy.json
index fc44bd0..6fe986b 100644
--- a/enterprise/macos-linux/edge-managed-policy.json
+++ b/enterprise/macos-linux/edge-managed-policy.json
@@ -18,10 +18,16 @@
                 "customRulesUrl": "",
                 "updateInterval": 24,
                 "enableDebugLogging": false,
+                "domainSquatting": {
+                    "enabled": true
+                },
                 "customBranding": {
                     "companyName": "",
                     "productName": "",
                     "supportEmail": "",
+                    "supportUrl": "",
+                    "privacyPolicyUrl": "",
+                    "aboutUrl": "",
                     "primaryColor": "#F77F00",
                     "logoUrl": ""
                 },
@@ -37,4 +43,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/manifest.firefox.json b/manifest.firefox.json
index e8eb957..d163c20 100644
--- a/manifest.firefox.json
+++ b/manifest.firefox.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Check by CyberDrain",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Protect against phishing attacks targeting Microsoft 365 login pages with enterprise-grade detection",
   "permissions": [
     "storage",
@@ -67,7 +67,10 @@
   "browser_specific_settings": {
     "gecko": {
       "id": "check@cyberdrain.com",
-      "strict_min_version": "109.0"
+      "strict_min_version": "142.0",
+      "data_collection_permissions": {
+        "required": ["none"]
+      }
     }
   }
 }
diff --git a/manifest.json b/manifest.json
index ca78360..04fe37c 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Check by CyberDrain",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Protect against phishing attacks targeting Microsoft 365 login pages with enterprise-grade detection",
   "permissions": [
     "storage",
diff --git a/options/options.css b/options/options.css
index 5e4ab92..a81a7aa 100644
--- a/options/options.css
+++ b/options/options.css
@@ -722,6 +722,96 @@ body {
   letter-spacing: 0.3px;
 }
 
+/* Collapsible config sections */
+.config-section-collapsible {
+  margin-bottom: 12px;
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius);
+  overflow: hidden;
+  background: var(--surface-color);
+}
+
+.config-section-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 16px;
+  cursor: pointer;
+  user-select: none;
+  background: var(--surface-color);
+  transition: background-color 0.2s ease;
+}
+
+.config-section-header:hover {
+  background: var(--background-color);
+}
+
+.config-section-header-title {
+  font-weight: 600;
+  color: var(--primary-color);
+  font-size: 13px;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.config-section-toggle {
+  color: var(--text-muted);
+  font-size: 20px;
+  transition: transform 0.2s ease;
+  line-height: 1;
+  transform: rotate(180deg);
+}
+
+.config-section-collapsible.expanded .config-section-toggle {
+  transform: rotate(90deg);
+}
+
+.config-section-content {
+  max-height: 0;
+  overflow: hidden;
+  transition: max-height 0.6s ease-out;
+}
+
+.config-section-collapsible.expanded .config-section-content {
+  max-height: 2000px; /* Large enough for content */
+  transition: max-height 0.8s ease-in;
+}
+
+.config-section-body {
+  padding: 12px 16px;
+  border-top: 1px solid var(--border-color);
+}
+
+/* Nested collapsible for lists */
+.config-list-toggle {
+  color: var(--primary-color);
+  cursor: pointer;
+  text-decoration: underline;
+  font-size: 12px;
+  margin-top: 8px;
+  display: inline-block;
+  transition: color 0.2s ease;
+}
+
+.config-list-toggle:hover {
+  color: var(--primary-hover);
+}
+
+.config-list-expanded {
+  margin-top: 0;
+  margin-bottom: 8px;
+  padding-left: 0;
+  display: none;
+  transition: all 0.5s ease;
+}
+
+.config-list-expanded.visible {
+  display: block;
+}
+
 .config-raw-json {
   white-space: pre-wrap;
   font-family: 'Monaco', 'Menlo', 'Ubuntu Mono', monospace;
diff --git a/options/options.html b/options/options.html
index 7a69aea..72f1534 100644
--- a/options/options.html
+++ b/options/options.html
@@ -169,6 +169,11 @@ <h3>Generic Webhook</h3>
                                     <span class="checkbox-custom"></span>
                                     Rogue App Detected
                                 </label>
+                                <label class="setting-label">
+                                    <input type="checkbox" id="webhookEvent_domain_squatting_detected" class="setting-checkbox">
+                                    <span class="checkbox-custom"></span>
+                                    Domain Squatting Detected
+                                </label>
                                 <label class="setting-label">
                                     <input type="checkbox" id="webhookEvent_threat_detected" class="setting-checkbox">
                                     <span class="checkbox-custom"></span>
@@ -242,8 +247,17 @@ <h3>Detection Configuration</h3>
                             <label class="setting-label">
                                 URL Allowlist (Regex or URL with wildcards)
                                 <textarea id="urlAllowlist" class="setting-textarea" rows="6" placeholder="Enter URLs or regex patterns, one per line:&#10;&#10;Simple URLs with wildcards:&#10;https://google.com/*&#10;https://*.microsoft.com/*&#10;&#10;Advanced regex patterns:&#10;^https://trusted\.example\.com/.*"></textarea>
+            </label>
+                            <p class="setting-description">Add URLs or regex patterns to allowlist from detection. Use simple URLs with * wildcards (e.g., https://google.com/*) or advanced regex patterns. These will be added to the exclusion rules without replacing the entire ruleset. <strong>This allowlist also protects the extracted domains from typosquatting, homoglyphs, and other domain squatting attacks.</strong></p>
+                        </div>
+
+                        <div class="setting-item">
+                            <label class="setting-label">
+                                <input type="checkbox" id="domainSquattingEnabled" class="setting-checkbox">
+                                <span class="checkbox-custom"></span>
+                                Enable Domain Squatting Detection
                             </label>
-                            <p class="setting-description">Add URLs or regex patterns to allowlist from detection. Use simple URLs with * wildcards (e.g., https://google.com/*) or advanced regex patterns. These will be added to the exclusion rules without replacing the entire ruleset.</p>
+                            <p class="setting-description">Enable or disable typosquatting, homoglyph, and combosquatting detection. Protected domains continue to come from detection rules and your URL allowlist.</p>
                         </div>
 
                         <div class="setting-item">
@@ -260,10 +274,16 @@ <h3>Detection Configuration</h3>
                     <div class="setting-group">
                         <div class="config-header">
                             <h3>Configuration Overview</h3>
-                            <button class="btn btn-secondary small" id="toggleConfigView">
-                                <span class="material-icons">code</span>
-                                Show Raw JSON
-                            </button>
+                            <div style="display: flex; gap: 8px;">
+                                <button class="btn btn-secondary small" id="expandCollapseAll">
+                                    <span class="material-icons">unfold_more</span>
+                                    Expand All
+                                </button>
+                                <button class="btn btn-secondary small" id="toggleConfigView">
+                                    <span class="material-icons">code</span>
+                                    Show Raw JSON
+                                </button>
+                            </div>
                         </div>
                         <div id="configDisplay" class="config-display">
                             <div class="config-loading">Loading configuration...</div>
@@ -382,14 +402,6 @@ <h3>Company Information</h3>
                             <p class="setting-description">Company name displayed in the extension</p>
                         </div>
 
-                        <div class="setting-item">
-                            <label class="setting-label">
-                                Company URL
-                                <input type="url" id="companyURL" class="setting-input" placeholder="https://yourcompany.com">
-                            </label>
-                            <p class="setting-description">Your company website URL</p>
-                        </div>
-
                         <div class="setting-item">
                             <label class="setting-label">
                                 Product Name
@@ -405,6 +417,30 @@ <h3>Company Information</h3>
                             </label>
                             <p class="setting-description">Email address for user support</p>
                         </div>
+
+                        <div class="setting-item">
+                            <label class="setting-label">
+                                Support URL
+                                <input type="url" id="supportUrl" class="setting-input" placeholder="https://support.yourcompany.com">
+                            </label>
+                            <p class="setting-description">URL opened by the popup Support button</p>
+                        </div>
+
+                        <div class="setting-item">
+                            <label class="setting-label">
+                                Privacy URL
+                                <input type="url" id="privacyPolicyUrl" class="setting-input" placeholder="https://yourcompany.com/privacy">
+                            </label>
+                            <p class="setting-description">URL opened by the popup Privacy button</p>
+                        </div>
+
+                        <div class="setting-item">
+                            <label class="setting-label">
+                                About URL
+                                <input type="url" id="aboutUrl" class="setting-input" placeholder="https://yourcompany.com/about">
+                            </label>
+                            <p class="setting-description">URL opened by the popup About button (leave empty to use extension About page)</p>
+                        </div>
                     </div>
 
                     <div class="setting-group">
@@ -566,35 +602,5 @@ <h3 class="modal-title" id="modalTitle">Confirm Action</h3>
 
     <script src="../scripts/browser-polyfill-inline.js"></script>
     <script src="options.js"></script>
-    <script>
-    // Minimal config summary: just show code-driven indicator count and key settings
-    function renderConfigSummary(config) {
-        const codeDrivenDiv = document.getElementById('codeDrivenIndicators');
-        const keySettingsUl = document.getElementById('configKeySettings');
-        if (!config || !config.phishing_indicators) return;
-        // Show only code-driven indicator count
-        const codeDrivenCount = config.phishing_indicators.filter(r => r.code_driven).length;
-        codeDrivenDiv.innerHTML = `<div class="config-item"><strong>Code-Driven Indicators:</strong> <span class="config-value">${codeDrivenCount}</span></div>`;
-        // Show some key settings
-        keySettingsUl.innerHTML = '';
-        if (config.version) keySettingsUl.innerHTML += `<li><strong>Rules Version:</strong> ${config.version}</li>`;
-        if (config.lastUpdated) keySettingsUl.innerHTML += `<li><strong>Last Updated:</strong> ${config.lastUpdated}</li>`;
-        if (config.detection_settings && config.detection_settings.block_threshold !== undefined) {
-            keySettingsUl.innerHTML += `<li><strong>Block Threshold:</strong> ${config.detection_settings.block_threshold}</li>`;
-        }
-        if (config.detection_settings && config.detection_settings.warn_threshold !== undefined) {
-            keySettingsUl.innerHTML += `<li><strong>Warn Threshold:</strong> ${config.detection_settings.warn_threshold}</li>`;
-        }
-    }
-    // Patch into config loading logic
-    (function() {
-        const origShowConfig = window.showConfigDisplay;
-        window.showConfigDisplay = function(config) {
-            if (typeof origShowConfig === 'function') origShowConfig(config);
-            renderConfigSummary(config);
-            document.getElementById('configSummary').style.display = '';
-        };
-    })();
-    </script>
 </body>
 </html>
diff --git a/options/options.js b/options/options.js
index a24dc1f..491c5a9 100644
--- a/options/options.js
+++ b/options/options.js
@@ -60,12 +60,17 @@ class CheckOptions {
     this.elements.customRulesUrl = document.getElementById("customRulesUrl");
     this.elements.updateInterval = document.getElementById("updateInterval");
     this.elements.urlAllowlist = document.getElementById("urlAllowlist");
+    this.elements.domainSquattingEnabled = document.getElementById(
+      "domainSquattingEnabled"
+    );
     this.elements.refreshDetectionRules = document.getElementById(
       "refreshDetectionRules"
     );
     this.elements.configDisplay = document.getElementById("configDisplay");
     this.elements.toggleConfigView =
       document.getElementById("toggleConfigView");
+    this.elements.expandCollapseAll =
+      document.getElementById("expandCollapseAll");
 
     // Rule Playground elements
     this.elements.playgroundRulesInput = document.getElementById("playgroundRulesInput");
@@ -95,9 +100,11 @@ class CheckOptions {
 
     // Branding
     this.elements.companyName = document.getElementById("companyName");
-    this.elements.companyURL = document.getElementById("companyURL");
     this.elements.productName = document.getElementById("productName");
     this.elements.supportEmail = document.getElementById("supportEmail");
+    this.elements.supportUrl = document.getElementById("supportUrl");
+    this.elements.privacyPolicyUrl = document.getElementById("privacyPolicyUrl");
+    this.elements.aboutUrl = document.getElementById("aboutUrl");
     this.elements.primaryColor = document.getElementById("primaryColor");
     this.elements.logoUrl = document.getElementById("logoUrl");
     this.elements.brandingPreview = document.getElementById("brandingPreview");
@@ -164,6 +171,11 @@ class CheckOptions {
       this.toggleConfigView()
     );
 
+    // Expand/collapse all sections
+    this.elements.expandCollapseAll?.addEventListener("click", () =>
+      this.toggleExpandCollapseAll()
+    );
+
     // Simulate enterprise mode toggle (dev only)
     this.elements.simulateEnterpriseMode?.addEventListener("change", () =>
       this.toggleSimulateEnterpriseMode()
@@ -173,6 +185,9 @@ class CheckOptions {
     this.elements.refreshDetectionRules?.addEventListener("click", () =>
       this.refreshDetectionRules()
     );
+    
+    // Domain squatting management
+    // (View default domains now in Configuration Overview)
 
     // Playground actions
     this.elements.runRuleTestBtn?.addEventListener("click", () => this.runRulePlaygroundTest());
@@ -185,8 +200,10 @@ class CheckOptions {
     // Branding preview updates
     const brandingInputs = [
       this.elements.companyName,
-      this.elements.companyURL,
       this.elements.productName,
+      this.elements.supportUrl,
+      this.elements.privacyPolicyUrl,
+      this.elements.aboutUrl,
       this.elements.primaryColor,
       this.elements.logoUrl,
     ];
@@ -476,8 +493,10 @@ class CheckOptions {
       console.warn("Options: Using fallback branding configuration");
       this.brandingConfig = {
         companyName: "CyberDrain",
-    companyURL: "https://cyberdrain.com/",
         productName: "Check",
+        supportUrl: "",
+        privacyPolicyUrl: "",
+        aboutUrl: "",
         primaryColor: "#F77F00",
         logoUrl: "images/icon48.png",
       };
@@ -485,8 +504,10 @@ class CheckOptions {
       console.error("Error loading branding configuration:", error);
       this.brandingConfig = {
         companyName: "CyberDrain",
-		    companyURL: "https://cyberdrain.com/",
         productName: "Check",
+        supportUrl: "",
+        privacyPolicyUrl: "",
+        aboutUrl: "",
         primaryColor: "#F77F00",
         logoUrl: "images/icon48.png",
       };
@@ -838,7 +859,7 @@ class CheckOptions {
 
   renderPlaygroundResults(html) {
     if (!this.elements.playgroundResults) return;
-    this.elements.playgroundResults.innerHTML = html;
+    this.elements.playgroundResults.replaceChildren(this.createHtmlFragment(html));
   }
   /* ================= End Rule Playground ================= */
 
@@ -956,6 +977,7 @@ class CheckOptions {
       "false_positive_report",
       "page_blocked",
       "rogue_app_detected",
+      "domain_squatting_detected",
       "threat_detected",
       "validation_event"
     ];
@@ -976,6 +998,11 @@ class CheckOptions {
         : (allowlist || '');
     }
 
+    if (this.elements.domainSquattingEnabled) {
+      this.elements.domainSquattingEnabled.checked =
+        this.config?.domainSquatting?.enabled !== false;
+    }
+
     // Handle updateInterval - ensure we always show hours in the UI
     let updateIntervalHours = 24; // default
     if (this.config?.updateInterval) {
@@ -1011,9 +1038,12 @@ class CheckOptions {
 
     // Branding settings
     this.elements.companyName.value = this.brandingConfig?.companyName || "";
-    this.elements.companyURL.value = this.brandingConfig?.companyURL || "";
     this.elements.productName.value = this.brandingConfig?.productName || "";
     this.elements.supportEmail.value = this.brandingConfig?.supportEmail || "";
+    this.elements.supportUrl.value = this.brandingConfig?.supportUrl || "";
+    this.elements.privacyPolicyUrl.value =
+      this.brandingConfig?.privacyPolicyUrl || "";
+    this.elements.aboutUrl.value = this.brandingConfig?.aboutUrl || "";
     this.elements.primaryColor.value =
     this.brandingConfig?.primaryColor || "#F77F00";
     this.elements.logoUrl.value = this.brandingConfig?.logoUrl || "";
@@ -1174,7 +1204,9 @@ class CheckOptions {
   }
 
   gatherFormData() {
-       const formData = {
+      const existingDomainSquatting = this.config?.domainSquatting || {};
+
+      const formData = {
       // Extension settings
       enablePageBlocking: this.elements.enablePageBlocking?.checked !== false,
       enableCippReporting: this.elements.enableCippReporting?.checked || false,
@@ -1210,6 +1242,7 @@ class CheckOptions {
           "false_positive_report",
           "page_blocked",
           "rogue_app_detected",
+          "domain_squatting_detected",
           "threat_detected",
           "validation_event"
         ].filter(eventType => 
@@ -1222,6 +1255,27 @@ class CheckOptions {
         ? this.elements.urlAllowlist.value.split('\n').filter(line => line.trim())
         : [],
 
+      // Domain squatting settings (runtime control moved from rules JSON)
+      domainSquatting: {
+        enabled: this.elements.domainSquattingEnabled?.checked !== false,
+        deviationThreshold: existingDomainSquatting.deviationThreshold ?? 2,
+        algorithms: {
+          levenshtein:
+            existingDomainSquatting.algorithms?.levenshtein !== false,
+          homoglyph: existingDomainSquatting.algorithms?.homoglyph !== false,
+          typosquat: existingDomainSquatting.algorithms?.typosquat !== false,
+          combosquat: existingDomainSquatting.algorithms?.combosquat !== false,
+        },
+        protectedDomains: Array.isArray(existingDomainSquatting.protectedDomains)
+          ? existingDomainSquatting.protectedDomains
+          : [],
+        Action:
+          existingDomainSquatting.Action ||
+          existingDomainSquatting.action ||
+          "block",
+        logDetections: existingDomainSquatting.logDetections !== false,
+      },
+
       // Developer mode (debug logging auto-enabled when this is true)
       enableDeveloperConsoleLogging:
         this.elements.enableDeveloperConsoleLogging?.checked || false,
@@ -1339,9 +1393,11 @@ class CheckOptions {
   gatherBrandingData() {
     return {
       companyName: this.elements.companyName.value,
-      companyURL: this.elements.companyURL.value,
       productName: this.elements.productName.value,
       supportEmail: this.elements.supportEmail.value,
+      supportUrl: this.elements.supportUrl.value,
+      privacyPolicyUrl: this.elements.privacyPolicyUrl.value,
+      aboutUrl: this.elements.aboutUrl.value,
       primaryColor: this.elements.primaryColor.value,
       logoUrl: this.elements.logoUrl.value,
     };
@@ -1426,332 +1482,300 @@ class CheckOptions {
     if (!this.elements.configDisplay) return;
 
     const sections = [];
+    let sectionId = 0;
+
+    // Helper function to create collapsible section
+    const createCollapsibleSection = (title, content, expanded = false) => {
+      const id = `config-section-${sectionId++}`;
+      return `
+        <div class="config-section-collapsible ${expanded ? 'expanded' : ''}" data-section-id="${id}">
+          <div class="config-section-header" data-toggle-section="${id}">
+            <div class="config-section-header-title">${title}</div>
+            <span class="config-section-toggle">►</span>
+          </div>
+          <div class="config-section-content">
+            <div class="config-section-body">
+              ${content}
+            </div>
+          </div>
+        </div>
+      `;
+    };
 
-    // Basic info
-    sections.push(`
-      <div class="config-section">
-        <div class="config-section-title">Basic Information</div>
-        <div class="config-item"><strong>Version:</strong> <span class="config-value">${
-          config.version || "Unknown"
-        }</span></div>
-        <div class="config-item"><strong>Last Updated:</strong> <span class="config-value">${
-          config.lastUpdated || "Unknown"
-        }</span></div>
-        <div class="config-item"><strong>Description:</strong> ${
-          config.description || "No description"
-        }</div>
-      </div>
-    `);
+    // Helper function to create expandable list
+    const createExpandableList = (items, label, showCount = 5) => {
+      if (!items || items.length === 0) return '';
+      
+      const listId = `list-${sectionId++}`;
+      const displayed = items.slice(0, showCount);
+      const remaining = items.slice(showCount);
+      
+      let html = displayed.map(item => `<div class="config-item">• ${item}</div>`).join('');
+      
+      if (remaining.length > 0) {
+        html += `
+          <div class="config-list-expanded" id="${listId}">
+            ${remaining.map(item => `<div class="config-item">• ${item}</div>`).join('')}
+          </div>
+          <div class="config-list-toggle" data-toggle-list="${listId}">
+            ▸ Show ${remaining.length} more ${label}
+          </div>
+        `;
+      }
+      
+      return html;
+    };
+
+    // Basic Information - Open by default
+    const basicInfoContent = `
+      <div class="config-item"><strong>Version:</strong> <span class="config-value">${config.version || "Unknown"}</span></div>
+      <div class="config-item"><strong>Last Updated:</strong> <span class="config-value">${config.lastUpdated || "Unknown"}</span></div>
+      <div class="config-item"><strong>Description:</strong> ${config.description || "No description"}</div>
+    `;
+    sections.push(createCollapsibleSection('Basic Information', basicInfoContent, true));
 
     // Detection Thresholds
     if (config.thresholds) {
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Detection Thresholds</div>
-          <div class="config-item"><strong>Legitimate Site Threshold:</strong> <span class="config-value">${config.thresholds.legitimate}%</span></div>
-          <div class="config-item"><strong>Suspicious Site Threshold:</strong> <span class="config-value">${config.thresholds.suspicious}%</span></div>
-          <div class="config-item"><strong>Phishing Site Threshold:</strong> <span class="config-value">${config.thresholds.phishing}%</span></div>
-        </div>
-      `);
+      const thresholdsContent = `
+        <div class="config-item"><strong>Legitimate Site Threshold:</strong> <span class="config-value">${config.thresholds.legitimate}%</span></div>
+        <div class="config-item"><strong>Suspicious Site Threshold:</strong> <span class="config-value">${config.thresholds.suspicious}%</span></div>
+        <div class="config-item"><strong>Phishing Site Threshold:</strong> <span class="config-value">${config.thresholds.phishing}%</span></div>
+      `;
+      sections.push(createCollapsibleSection('Detection Thresholds', thresholdsContent, false));
     }
 
     // Trusted Login Patterns
-    if (
-      config.trusted_login_patterns &&
-      config.trusted_login_patterns.length > 0
-    ) {
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Trusted Login Patterns (${
-            config.trusted_login_patterns.length
-          })</div>
-          ${config.trusted_login_patterns
-            .slice(0, 5)
-            .map((pattern) => `<div class="config-item">• ${pattern}</div>`)
-            .join("")}
-          ${
-            config.trusted_login_patterns.length > 5
-              ? `<div class="config-item">... and ${
-                  config.trusted_login_patterns.length - 5
-                } more</div>`
-              : ""
-          }
-        </div>
-      `);
-    }
-
-    // Microsoft 365 Detection Requirements
-    if (config.m365_detection_requirements) {
-      const req = config.m365_detection_requirements;
-      const primaryCount = req.primary_elements
-        ? req.primary_elements.length
-        : 0;
-      const secondaryCount = req.secondary_elements
-        ? req.secondary_elements.length
-        : 0;
-
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Microsoft 365 Detection Requirements</div>
-          <div class="config-item"><strong>Primary Elements:</strong> <span class="config-value">${primaryCount}</span></div>
-          <div class="config-item"><strong>Secondary Elements:</strong> <span class="config-value">${secondaryCount}</span></div>
-          <div class="config-item"><strong>Description:</strong> ${
-            req.description || "No description"
-          }</div>
-        </div>
-      `);
+    if (config.trusted_login_patterns && config.trusted_login_patterns.length > 0) {
+      const patternsContent = createExpandableList(config.trusted_login_patterns, 'patterns', 5);
+      sections.push(createCollapsibleSection(
+        `Trusted Login Patterns (${config.trusted_login_patterns.length})`,
+        patternsContent,
+        false
+      ));
     }
 
     // Microsoft Domain Patterns
-    if (
-      config.microsoft_domain_patterns &&
-      config.microsoft_domain_patterns.length > 0
-    ) {
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Microsoft Domain Patterns (${
-            config.microsoft_domain_patterns.length
-          })</div>
-          ${config.microsoft_domain_patterns
-            .slice(0, 10)
-            .map((pattern) => `<div class="config-item">• ${pattern}</div>`)
-            .join("")}
-          ${
-            config.microsoft_domain_patterns.length > 10
-              ? `<div class="config-item">... and ${
-                  config.microsoft_domain_patterns.length - 10
-                } more</div>`
-              : ""
-          }
-        </div>
-      `);
+    if (config.microsoft_domain_patterns && config.microsoft_domain_patterns.length > 0) {
+      const domainsContent = createExpandableList(config.microsoft_domain_patterns, 'domains', 10);
+      sections.push(createCollapsibleSection(
+        `Microsoft Domain Patterns (${config.microsoft_domain_patterns.length})`,
+        domainsContent,
+        false
+      ));
+    }
+
+    // Domain Squatting Detection
+    if (config.domain_squatting) {
+      const ds = config.domain_squatting;
+      const runtimeDs = this.config?.domainSquatting || {};
+      const effectiveAlgorithms = {
+        ...(ds.algorithms || {}),
+        ...(runtimeDs.algorithms || {}),
+      };
+      const protectedDomains = [
+        ...(Array.isArray(ds.protected_domains) ? ds.protected_domains : []),
+        ...(Array.isArray(runtimeDs.protectedDomains)
+          ? runtimeDs.protectedDomains
+          : []),
+      ];
+      const uniqueProtectedDomains = [...new Set(protectedDomains)];
+
+      let squattingContent = `
+        <div class="config-item"><strong>Enabled (Settings):</strong> <span class="config-value">${runtimeDs.enabled !== false ? 'Yes' : 'No'}</span></div>
+        <div class="config-item"><strong>Deviation Threshold:</strong> <span class="config-value">${runtimeDs.deviationThreshold ?? ds.deviation_threshold ?? 2}</span></div>
+        <div class="config-item"><strong>Action:</strong> <span class="config-value">${runtimeDs.Action || runtimeDs.action || ds.action || 'block'}</span></div>
+        <div class="config-item"><strong>Severity:</strong> <span class="config-value">${ds.severity || 'high'}</span></div>
+      `;
+      
+      if (Object.keys(effectiveAlgorithms).length > 0) {
+        squattingContent += `<div class="config-item" style="margin-top: 8px;"><strong>Algorithms:</strong></div>`;
+        if (effectiveAlgorithms.levenshtein !== false) squattingContent += `<div class="config-item" style="margin-left: 16px;">✓ Levenshtein Distance</div>`;
+        if (effectiveAlgorithms.homoglyph !== false) squattingContent += `<div class="config-item" style="margin-left: 16px;">✓ Homoglyph Detection</div>`;
+        if (effectiveAlgorithms.typosquat !== false) squattingContent += `<div class="config-item" style="margin-left: 16px;">✓ Typosquatting</div>`;
+        if (effectiveAlgorithms.combosquat !== false) squattingContent += `<div class="config-item" style="margin-left: 16px;">✓ Combosquatting</div>`;
+      }
+      
+      if (uniqueProtectedDomains.length > 0) {
+        squattingContent += `<div class="config-item" style="margin-top: 8px;"><strong>Protected Domains (${uniqueProtectedDomains.length}):</strong></div>`;
+        squattingContent += createExpandableList(uniqueProtectedDomains, 'domains', 10);
+      }
+      
+      sections.push(createCollapsibleSection('Domain Squatting Detection', squattingContent, false));
     }
 
-    // Exclusion System
-    if (config.exclusion_system) {
-      const exclusions = config.exclusion_system;
-      const domainPatterns = exclusions.domain_patterns || [];
-      const legitimateContexts =
-        exclusions.context_indicators?.legitimate_contexts || [];
-      const legitimateSsoPatterns =
-        exclusions.context_indicators?.legitimate_sso_patterns || [];
-      const suspiciousContexts =
-        exclusions.context_indicators?.suspicious_contexts || [];
-
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Exclusion System</div>
-          <div class="config-item"><strong>Domain Patterns:</strong> <span class="config-value">${
-            domainPatterns.length
-          }</span></div>
-          <div class="config-item"><strong>Legitimate Context Indicators:</strong> <span class="config-value">${
-            legitimateContexts.length
-          }</span></div>
-          <div class="config-item"><strong>Legitimate SSO Patterns:</strong> <span class="config-value">${
-            legitimateSsoPatterns.length
-          }</span></div>
-          <div class="config-item"><strong>Suspicious Context Indicators:</strong> <span class="config-value">${
-            suspiciousContexts.length
-          }</span></div>
-          <div class="config-item"><strong>Description:</strong> ${
-            exclusions.description || "No description"
-          }</div>
-          ${
-            domainPatterns.length > 0
-              ? `<div class="config-subsection">
-              <div class="config-subsection-title">Sample Domain Patterns:</div>
-              ${domainPatterns
-                .slice(0, 5)
-                .map((pattern) => `<div class="config-item">• ${pattern}</div>`)
-                .join("")}
-              ${
-                domainPatterns.length > 5
-                  ? `<div class="config-item">... and ${
-                      domainPatterns.length - 5
-                    } more</div>`
-                  : ""
-              }
-            </div>`
-              : ""
-          }
-        </div>
-      `);
+    // Rogue Apps Detection
+    if (config.rogue_apps_detection) {
+      const rogue = config.rogue_apps_detection;
+      const rogueContent = `
+        <div class="config-item"><strong>Enabled:</strong> <span class="config-value">${rogue.enabled ? 'Yes' : 'No'}</span></div>
+        <div class="config-item"><strong>Source URL:</strong> <span class="config-value" style="font-size: 10px; word-break: break-all;">${rogue.source_url || 'None'}</span></div>
+        <div class="config-item"><strong>Cache Duration:</strong> <span class="config-value">${Math.round((rogue.cache_duration || 0) / 3600000)}h</span></div>
+        <div class="config-item"><strong>Update Interval:</strong> <span class="config-value">${Math.round((rogue.update_interval || 0) / 3600000)}h</span></div>
+        <div class="config-item"><strong>Detection Action:</strong> <span class="config-value">${rogue.detection_action || 'None'}</span></div>
+        <div class="config-item"><strong>Auto Update:</strong> <span class="config-value">${rogue.auto_update ? 'Yes' : 'No'}</span></div>
+      `;
+      sections.push(createCollapsibleSection('Rogue Apps Detection', rogueContent, false));
     }
 
     // Phishing Indicators Summary
     if (config.phishing_indicators && config.phishing_indicators.length > 0) {
       const indicatorTypes = {};
-      const criticalCount = config.phishing_indicators.filter(
-        (indicator) => indicator.severity === "critical"
-      ).length;
+      const criticalCount = config.phishing_indicators.filter(i => i.severity === 'critical').length;
+      const codeDrivenCount = config.phishing_indicators.filter(i => i.code_driven).length;
 
       config.phishing_indicators.forEach((indicator) => {
-        const type = indicator.type || "unknown";
+        const type = indicator.type || indicator.category || 'unknown';
         indicatorTypes[type] = (indicatorTypes[type] || 0) + 1;
       });
 
-      const indicatorSections = Object.entries(indicatorTypes)
-        .map(
-          ([type, count]) =>
-            `<div class="config-item"><strong>${type}:</strong> <span class="config-value">${count}</span></div>`
-        )
-        .join("");
-
-      // Code-driven indicators summary
-      const codeDrivenIndicators = config.phishing_indicators.filter(r => r.code_driven);
-      let codeDrivenHtml = '';
-      if (codeDrivenIndicators.length > 0) {
-        codeDrivenHtml = `<div class="config-item"><strong>Code-Driven Indicators:</strong> <span class="config-value">${codeDrivenIndicators.length}</span></div>`;
-      }
+      let indicatorsContent = `
+        <div class="config-item"><strong>Total Indicators:</strong> <span class="config-value">${config.phishing_indicators.length}</span></div>
+        <div class="config-item"><strong>Critical Severity:</strong> <span class="config-value">${criticalCount}</span></div>
+        <div class="config-item"><strong>Code-Driven:</strong> <span class="config-value">${codeDrivenCount}</span></div>
+        <div class="config-item" style="margin-top: 8px;"><strong>By Type:</strong></div>
+      `;
+      
+      Object.entries(indicatorTypes).forEach(([type, count]) => {
+        indicatorsContent += `<div class="config-item" style="margin-left: 16px;">${type}: <span class="config-value">${count}</span></div>`;
+      });
 
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Phishing Indicators (${config.phishing_indicators.length} total)</div>
-          <div class="config-item"><strong>Critical Severity Rules:</strong> <span class="config-value">${criticalCount}</span></div>
-          ${indicatorSections}
-          ${codeDrivenHtml}
-        </div>
-      `);
-    }
-
-    // Legacy format support - Trusted origins
-    if (config.trusted_origins && config.trusted_origins.length > 0) {
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Trusted Origins (${
-            config.trusted_origins.length
-          })</div>
-          ${config.trusted_origins
-            .map((origin) => `<div class="config-item">• ${origin}</div>`)
-            .join("")}
-        </div>
-      `);
+      sections.push(createCollapsibleSection('Phishing Indicators', indicatorsContent, false));
     }
 
-    // Legacy format support - Pattern categories
-    const patternSections = [];
-    if (config.phishing && config.phishing.length > 0) {
-      patternSections.push(
-        `<div class="config-item"><strong>Phishing Patterns:</strong> <span class="config-value">${config.phishing.length}</span></div>`
-      );
-    }
-    if (config.malicious && config.malicious.length > 0) {
-      patternSections.push(
-        `<div class="config-item"><strong>Malicious Patterns:</strong> <span class="config-value">${config.malicious.length}</span></div>`
-      );
-    }
-    if (config.suspicious && config.suspicious.length > 0) {
-      patternSections.push(
-        `<div class="config-item"><strong>Suspicious Patterns:</strong> <span class="config-value">${config.suspicious.length}</span></div>`
-      );
-    }
-    if (config.legitimate_patterns && config.legitimate_patterns.length > 0) {
-      patternSections.push(
-        `<div class="config-item"><strong>Legitimate Patterns:</strong> <span class="config-value">${config.legitimate_patterns.length}</span></div>`
-      );
-    }
+    // Microsoft 365 Detection Requirements
+    if (config.m365_detection_requirements) {
+      const req = config.m365_detection_requirements;
+      const primaryCount = req.primary_elements ? req.primary_elements.length : 0;
+      const secondaryCount = req.secondary_elements ? req.secondary_elements.length : 0;
 
-    if (patternSections.length > 0) {
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Legacy Pattern Categories</div>
-          ${patternSections.join("")}
-        </div>
-      `);
+      const m365Content = `
+        <div class="config-item"><strong>Primary Elements:</strong> <span class="config-value">${primaryCount}</span></div>
+        <div class="config-item"><strong>Secondary Elements:</strong> <span class="config-value">${secondaryCount}</span></div>
+        <div class="config-item"><strong>Description:</strong> ${req.description || 'No description'}</div>
+      `;
+      sections.push(createCollapsibleSection('Microsoft 365 Detection Requirements', m365Content, false));
     }
 
-    // Rogue apps detection
-    if (config.rogue_apps_detection) {
-      const rogue = config.rogue_apps_detection;
-      sections.push(`
-        <div class="config-section">
-          <div class="config-section-title">Rogue Apps Detection</div>
-          <div class="config-item"><strong>Enabled:</strong> <span class="config-value">${
-            rogue.enabled ? "Yes" : "No"
-          }</span></div>
-          <div class="config-item"><strong>Source:</strong> <span class="config-value">${
-            rogue.source_url ? rogue.source_url : "None"
-          }</span></div>
-          <div class="config-item"><strong>Cache Duration:</strong> <span class="config-value">${Math.round(
-            (rogue.cache_duration || 0) / 3600000
-          )}h</span></div>
-          <div class="config-item"><strong>Update Interval:</strong> <span class="config-value">${Math.round(
-            (rogue.update_interval || 0) / 3600000
-          )}h</span></div>
-          <div class="config-item"><strong>Detection Action:</strong> <span class="config-value">${
-            rogue.detection_action || "None"
-          }</span></div>
-          <div class="config-item"><strong>Auto Update:</strong> <span class="config-value">${
-            rogue.auto_update ? "Yes" : "No"
-          }</span></div>
-        </div>
-      `);
+    // Exclusion System
+    if (config.exclusion_system) {
+      const exclusions = config.exclusion_system;
+      const domainPatterns = exclusions.domain_patterns || [];
+      const legitimateContexts = exclusions.context_indicators?.legitimate_contexts || [];
+      const legitimateSsoPatterns = exclusions.context_indicators?.legitimate_sso_patterns || [];
+      const suspiciousContexts = exclusions.context_indicators?.suspicious_contexts || [];
+
+      let exclusionsContent = `
+        <div class="config-item"><strong>Domain Patterns:</strong> <span class="config-value">${domainPatterns.length}</span></div>
+        <div class="config-item"><strong>Legitimate Context Indicators:</strong> <span class="config-value">${legitimateContexts.length}</span></div>
+        <div class="config-item"><strong>Legitimate SSO Patterns:</strong> <span class="config-value">${legitimateSsoPatterns.length}</span></div>
+        <div class="config-item"><strong>Suspicious Context Indicators:</strong> <span class="config-value">${suspiciousContexts.length}</span></div>
+      `;
+      
+      if (domainPatterns.length > 0) {
+        exclusionsContent += `<div class="config-item" style="margin-top: 8px;"><strong>Domain Patterns:</strong></div>`;
+        exclusionsContent += createExpandableList(domainPatterns, 'patterns', 5);
+      }
+
+      sections.push(createCollapsibleSection('Exclusion System', exclusionsContent, false));
     }
 
-    // Configuration statistics
+    // Configuration Statistics
     let totalPatterns = 0;
-    if (config.phishing_indicators)
-      totalPatterns += config.phishing_indicators.length;
+    if (config.phishing_indicators) totalPatterns += config.phishing_indicators.length;
     if (config.phishing) totalPatterns += config.phishing.length;
     if (config.malicious) totalPatterns += config.malicious.length;
     if (config.suspicious) totalPatterns += config.suspicious.length;
-    if (config.legitimate_patterns)
-      totalPatterns += config.legitimate_patterns.length;
+    if (config.legitimate_patterns) totalPatterns += config.legitimate_patterns.length;
 
-    let totalDetectionElements = 0;
-    if (config.m365_detection_requirements) {
-      if (config.m365_detection_requirements.primary_elements)
-        totalDetectionElements +=
-          config.m365_detection_requirements.primary_elements.length;
-      if (config.m365_detection_requirements.secondary_elements)
-        totalDetectionElements +=
-          config.m365_detection_requirements.secondary_elements.length;
+    let criticalRules = 0;
+    if (config.phishing_indicators) {
+      criticalRules = config.phishing_indicators.filter(i => i.severity === 'critical').length;
     }
 
-    let totalExclusions = 0;
-    if (config.exclusion_system) {
-      if (config.exclusion_system.domain_patterns)
-        totalExclusions += config.exclusion_system.domain_patterns.length;
-      if (config.exclusion_system.context_indicators?.legitimate_contexts)
-        totalExclusions +=
-          config.exclusion_system.context_indicators.legitimate_contexts.length;
-      if (config.exclusion_system.context_indicators?.legitimate_sso_patterns)
-        totalExclusions +=
-          config.exclusion_system.context_indicators.legitimate_sso_patterns
-            .length;
-      if (config.exclusion_system.context_indicators?.suspicious_contexts)
-        totalExclusions +=
-          config.exclusion_system.context_indicators.suspicious_contexts.length;
+    const statsContent = `
+      <div class="config-item"><strong>Total Detection Patterns:</strong> <span class="config-value">${totalPatterns}</span></div>
+      <div class="config-item"><strong>Trusted Login Patterns:</strong> <span class="config-value">${config.trusted_login_patterns ? config.trusted_login_patterns.length : 0}</span></div>
+      <div class="config-item"><strong>Microsoft Domain Patterns:</strong> <span class="config-value">${config.microsoft_domain_patterns ? config.microsoft_domain_patterns.length : 0}</span></div>
+      <div class="config-item"><strong>Critical Severity Rules:</strong> <span class="config-value">${criticalRules}</span></div>
+    `;
+    sections.push(createCollapsibleSection('Configuration Statistics', statsContent, false));
+
+    this.elements.configDisplay.replaceChildren(
+      this.createHtmlFragment(sections.join(""))
+    );
+    
+    // Add event delegation for collapsible sections
+    this.elements.configDisplay.querySelectorAll('[data-toggle-section]').forEach(header => {
+      header.addEventListener('click', () => {
+        const sectionId = header.getAttribute('data-toggle-section');
+        this.toggleConfigSection(sectionId);
+      });
+    });
+    
+    // Add event delegation for expandable lists
+    this.elements.configDisplay.querySelectorAll('[data-toggle-list]').forEach(toggle => {
+      toggle.addEventListener('click', () => {
+        const listId = toggle.getAttribute('data-toggle-list');
+        this.toggleConfigList(listId);
+      });
+    });
+  }
+
+  toggleConfigSection(sectionId) {
+    const section = document.querySelector(`[data-section-id="${sectionId}"]`);
+    if (section) {
+      section.classList.toggle('expanded');
     }
+  }
 
-    let criticalRules = 0;
-    if (config.phishing_indicators) {
-      criticalRules = config.phishing_indicators.filter(
-        (indicator) => indicator.severity === "critical"
-      ).length;
-    }
-
-    sections.push(`
-      <div class="config-section">
-        <div class="config-section-title">Configuration Statistics</div>
-        <div class="config-item"><strong>Total Detection Patterns:</strong> <span class="config-value">${totalPatterns}</span></div>
-        <div class="config-item"><strong>Microsoft 365 Detection Elements:</strong> <span class="config-value">${totalDetectionElements}</span></div>
-        <div class="config-item"><strong>Trusted Login Patterns:</strong> <span class="config-value">${
-          config.trusted_login_patterns
-            ? config.trusted_login_patterns.length
-            : 0
-        }</span></div>
-        <div class="config-item"><strong>Microsoft Domain Patterns:</strong> <span class="config-value">${
-          config.microsoft_domain_patterns
-            ? config.microsoft_domain_patterns.length
-            : 0
-        }</span></div>
-        <div class="config-item"><strong>Critical Severity Rules:</strong> <span class="config-value">${criticalRules}</span></div>
-        <div class="config-item"><strong>Total Exclusions:</strong> <span class="config-value">${totalExclusions}</span></div>
-      </div>
-    `);
+  toggleConfigList(listId) {
+    const list = document.getElementById(listId);
+    const toggle = list?.nextElementSibling;
+    if (list && toggle) {
+      const isVisible = list.classList.contains('visible');
+      list.classList.toggle('visible');
+      if (isVisible) {
+        const remaining = list.querySelectorAll('.config-item').length;
+        const label = toggle.textContent.match(/more (.+)$/)?.[1] || 'items';
+        toggle.textContent = `▸ Show ${remaining} more ${label}`;
+      } else {
+        toggle.textContent = `▾ Hide details`;
+      }
+    }
+  }
+
+  toggleExpandCollapseAll() {
+    const sections = document.querySelectorAll('.config-section-collapsible');
+    if (!sections.length) return;
+
+    // Check if any section is collapsed
+    const hasCollapsed = Array.from(sections).some(section => !section.classList.contains('expanded'));
+    
+    // If any are collapsed, expand all. Otherwise, collapse all.
+    sections.forEach(section => {
+      if (hasCollapsed) {
+        section.classList.add('expanded');
+      } else {
+        section.classList.remove('expanded');
+      }
+    });
 
-    this.elements.configDisplay.innerHTML = sections.join("");
+    // Update button text
+    if (this.elements.expandCollapseAll) {
+      if (hasCollapsed) {
+        this.setButtonIconAndLabel(
+          this.elements.expandCollapseAll,
+          "unfold_less",
+          "Collapse All"
+        );
+      } else {
+        this.setButtonIconAndLabel(
+          this.elements.expandCollapseAll,
+          "unfold_more",
+          "Expand All"
+        );
+      }
+    }
   }
 
   toggleConfigView() {
@@ -1762,21 +1786,18 @@ class CheckOptions {
 
     // Update button text and icon
     if (this.elements.toggleConfigView) {
-      const icon =
-        this.elements.toggleConfigView.querySelector(".material-icons");
-      const text =
-        this.elements.toggleConfigView.querySelector(
-          ".material-icons"
-        ).nextSibling;
-
       if (this.configViewMode === "raw") {
-        icon.textContent = "view_list";
-        this.elements.toggleConfigView.innerHTML =
-          '<span class="material-icons">view_list</span> Show Formatted';
+        this.setButtonIconAndLabel(
+          this.elements.toggleConfigView,
+          "view_list",
+          "Show Formatted"
+        );
       } else {
-        icon.textContent = "code";
-        this.elements.toggleConfigView.innerHTML =
-          '<span class="material-icons">code</span> Show Raw JSON';
+        this.setButtonIconAndLabel(
+          this.elements.toggleConfigView,
+          "code",
+          "Show Raw JSON"
+        );
       }
     }
 
@@ -1806,6 +1827,11 @@ class CheckOptions {
 
     console.log("Simulate Enterprise Mode:", this.simulateEnterpriseMode);
 
+    // If disabling, reload the original branding configuration first
+    if (!this.simulateEnterpriseMode) {
+      await this.loadBrandingConfiguration();
+    }
+
     // Reload the policy information to apply/remove enterprise restrictions
     await this.loadPolicyInfo();
 
@@ -1815,7 +1841,7 @@ class CheckOptions {
     // Show notification to user
     const mode = this.simulateEnterpriseMode ? "enabled" : "disabled";
     this.showToast(
-      `Enterprise simulation mode ${mode}. Page will reflect policy restrictions.`,
+      `Enterprise simulation mode ${mode}. Page will reflect ${this.simulateEnterpriseMode ? 'policy restrictions' : 'original settings'}.`,
       "info"
     );
   }
@@ -1824,11 +1850,10 @@ class CheckOptions {
     if (!this.currentConfigData || !this.elements.configDisplay) return;
 
     if (this.configViewMode === "raw") {
-      this.elements.configDisplay.innerHTML = `<div class="config-raw-json">${JSON.stringify(
-        this.currentConfigData,
-        null,
-        2
-      )}</div>`;
+      const raw = document.createElement("div");
+      raw.className = "config-raw-json";
+      raw.textContent = JSON.stringify(this.currentConfigData, null, 2);
+      this.elements.configDisplay.replaceChildren(raw);
     } else {
       this.displayConfigInCard(this.currentConfigData);
     }
@@ -1888,8 +1913,13 @@ class CheckOptions {
     if (logs.length === 0) {
       const item = document.createElement("div");
       item.className = "log-entry";
-      item.innerHTML =
-        '<div class="log-column" style="grid-column: 1 / -1; text-align: center; color: #9ca3af;">No logs available</div>';
+      const empty = document.createElement("div");
+      empty.className = "log-column";
+      empty.style.gridColumn = "1 / -1";
+      empty.style.textAlign = "center";
+      empty.style.color = "#9ca3af";
+      empty.textContent = "No logs available";
+      item.appendChild(empty);
       this.elements.logsList.appendChild(item);
       return;
     }
@@ -1947,7 +1977,7 @@ class CheckOptions {
       // Expand icon
       const expandIcon = document.createElement("div");
       expandIcon.className = "log-expand-icon";
-      expandIcon.innerHTML = "▶";
+      expandIcon.textContent = "▶";
 
       // Append all columns to main row
       mainRow.appendChild(timestamp);
@@ -1961,7 +1991,9 @@ class CheckOptions {
       // Details section (initially hidden)
       const detailsSection = document.createElement("div");
       detailsSection.className = "log-entry-details";
-      detailsSection.innerHTML = this.createLogDetailsHTML(log);
+      detailsSection.replaceChildren(
+        this.createHtmlFragment(this.createLogDetailsHTML(log))
+      );
 
       // Append both main row and details to the item
       item.appendChild(mainRow);
@@ -2303,13 +2335,21 @@ class CheckOptions {
       await navigator.clipboard.writeText(decodedText);
 
       // Visual feedback
-      const originalText = button.innerHTML;
-      button.innerHTML =
-        '<span class="material-icons" style="font-size: 14px;">check</span>';
+      const icon = button.querySelector(".material-icons");
+      const originalIcon = icon ? icon.textContent : "";
+      if (icon) {
+        icon.textContent = "check";
+      } else {
+        button.textContent = "✓";
+      }
       button.classList.add("copied");
 
       setTimeout(() => {
-        button.innerHTML = originalText;
+        if (icon) {
+          icon.textContent = originalIcon || "content_copy";
+        } else {
+          button.textContent = "";
+        }
         button.classList.remove("copied");
       }, 2000);
     } catch (err) {
@@ -2327,13 +2367,21 @@ class CheckOptions {
       document.body.removeChild(textArea);
 
       // Visual feedback
-      const originalText = button.innerHTML;
-      button.innerHTML =
-        '<span class="material-icons" style="font-size: 14px;">check</span>';
+      const icon = button.querySelector(".material-icons");
+      const originalIcon = icon ? icon.textContent : "";
+      if (icon) {
+        icon.textContent = "check";
+      } else {
+        button.textContent = "✓";
+      }
       button.classList.add("copied");
 
       setTimeout(() => {
-        button.innerHTML = originalText;
+        if (icon) {
+          icon.textContent = originalIcon || "content_copy";
+        } else {
+          button.textContent = "";
+        }
         button.classList.remove("copied");
       }, 2000);
     }
@@ -2367,9 +2415,19 @@ class CheckOptions {
 
   // Decode HTML entities back to original text
   decodeHtml(html) {
-    const txt = document.createElement("textarea");
-    txt.innerHTML = html;
-    return txt.value;
+    if (!html) return "";
+    const entities = {
+      "&amp;": "&",
+      "&lt;": "<",
+      "&gt;": ">",
+      "&quot;": '"',
+      "&#039;": "'",
+      "&#39;": "'",
+    };
+    return String(html).replace(
+      /&amp;|&lt;|&gt;|&quot;|&#039;|&#39;/g,
+      (m) => entities[m] || m
+    );
   }
 
   // Mobile device detection
@@ -2457,8 +2515,10 @@ class CheckOptions {
           // Custom branding (matches managed_schema.json structure)
           customBranding: {
             companyName: "CyberDrain",
-            companyURL: "https://cyberdrain.com/",
             productName: "Check Enterprise",
+            supportUrl: "",
+            privacyPolicyUrl: "",
+            aboutUrl: "",
             primaryColor: "#F77F00",
             logoUrl:
               "https://cyberdrain.com/images/favicon_hu_20e77b0e20e363e.png",
@@ -2512,10 +2572,20 @@ class CheckOptions {
       } else {
         console.log("👤 No managed policies found - user mode");
 
+        // Clear managed policies
+        this.managedPolicies = null;
+
+        // Restore original branding (not enterprise branding)
+        await this.loadBrandingConfiguration();
+        this.applyBranding();
+
         // Hide policy badge
         if (this.elements.policyBadge) {
           this.elements.policyBadge.style.display = "none";
         }
+
+        // Re-enable all fields that might have been disabled by policies
+        this.enableAllPolicyManagedFields();
       }
     } catch (error) {
       console.error("Failed to load policy info:", error);
@@ -2594,13 +2664,16 @@ class CheckOptions {
       customRulesUrl: this.elements.customRulesUrl,
       updateInterval: this.elements.updateInterval,
       urlAllowlist: this.elements.urlAllowlist,
+      domainSquatting: this.elements.domainSquattingEnabled,
       enableDebugLogging: this.elements.enableDebugLogging,
       // Note: enableDeveloperConsoleLogging is excluded - should remain available for debugging
       // Branding fields (if customBranding policy is present)
       companyName: this.elements.companyName,
-      companyURL: this.elements.companyURL,
       productName: this.elements.productName,
       supportEmail: this.elements.supportEmail,
+      supportUrl: this.elements.supportUrl,
+      privacyPolicyUrl: this.elements.privacyPolicyUrl,
+      aboutUrl: this.elements.aboutUrl,
       primaryColor: this.elements.primaryColor,
       logoUrl: this.elements.logoUrl,
     };
@@ -2655,6 +2728,77 @@ class CheckOptions {
     }
   }
 
+  enableAllPolicyManagedFields() {
+    // Re-enable all fields that might have been disabled by policies
+    const allFields = [
+      this.elements.showNotifications,
+      this.elements.enableValidPageBadge,
+      this.elements.enablePageBlocking,
+      this.elements.enableCippReporting,
+      this.elements.cippServerUrl,
+      this.elements.cippTenantId,
+      this.elements.customRulesUrl,
+      this.elements.updateInterval,
+      this.elements.urlAllowlist,
+      this.elements.domainSquattingEnabled,
+      this.elements.enableDebugLogging,
+      this.elements.companyName,
+      this.elements.companyURL,
+      this.elements.productName,
+      this.elements.supportEmail,
+      this.elements.primaryColor,
+      this.elements.logoUrl,
+    ];
+
+    allFields.forEach((element) => {
+      if (element) {
+        element.disabled = false;
+        element.title = '';
+        element.classList.remove("policy-managed");
+
+        // Remove lock icons
+        const lockIcon = element.parentNode?.querySelector(".policy-lock");
+        if (lockIcon) {
+          lockIcon.remove();
+        }
+      }
+    });
+
+    // Re-enable the save button and restore original text
+    if (this.elements.saveSettings) {
+      this.elements.saveSettings.title = "Save all settings";
+      this.elements.saveSettings.textContent = "Save Settings";
+      this.elements.saveSettings.classList.remove("managed-mode");
+    }
+
+    // Re-show tabs that might have been hidden
+    const restrictedTabs = ["general", "detection", "branding"];
+    restrictedTabs.forEach((tabName) => {
+      const menuItem = document.querySelector(`[data-section="${tabName}"]`);
+      if (menuItem) {
+        const listItem = menuItem.closest("li");
+        if (listItem) {
+          listItem.style.display = "";
+        }
+      }
+    });
+
+    // Remove enterprise notice
+    const enterpriseNotice = document.querySelector(".enterprise-notice");
+    if (enterpriseNotice) {
+      enterpriseNotice.remove();
+    }
+
+    // Remove development notice
+    const devNotice = document.querySelector(".development-notice");
+    if (devNotice) {
+      devNotice.remove();
+    }
+
+    // Clear enterprise managed flag
+    this.isEnterpriseManaged = false;
+  }
+
   applyEnterpriseRestrictions(policies) {
     // Set enterprise managed flag
     this.isEnterpriseManaged = true;
@@ -2886,7 +3030,11 @@ class CheckOptions {
       log.event?.type === "threat_detected" ||
       log.event?.type === "content_threat_detected"
     ) {
-      return "HIGH";
+      const severity = log.event?.severity;
+      if (severity) {
+        return severity.toUpperCase();
+      }
+      return "MEDIUM";
     }
     if (log.category === "security") {
       return "MEDIUM";
@@ -2968,7 +3116,7 @@ class CheckOptions {
       log.event?.type === "content_threat_detected" ||
       log.event?.type === "threat_detected"
     ) {
-      return "BLOCKED";
+      return "WARNED";
     }
     if (log.event?.type === "url_access") {
       return "ALLOWED";
@@ -3102,8 +3250,8 @@ class CheckOptions {
     try {
       // Show a loading indicator
       if (this.elements.refreshLogs) {
-        const originalText = this.elements.refreshLogs.innerHTML;
-        this.elements.refreshLogs.innerHTML = "🔄 Refreshing...";
+        const originalText = this.elements.refreshLogs.textContent;
+        this.elements.refreshLogs.textContent = "🔄 Refreshing...";
         this.elements.refreshLogs.disabled = true;
 
         // Reload the logs
@@ -3113,7 +3261,7 @@ class CheckOptions {
         this.showToast("Logs refreshed successfully", "success");
 
         // Restore button state
-        this.elements.refreshLogs.innerHTML = originalText;
+        this.elements.refreshLogs.textContent = originalText;
         this.elements.refreshLogs.disabled = false;
       } else {
         // Fallback if button element not found
@@ -3126,12 +3274,33 @@ class CheckOptions {
 
       // Restore button state on error
       if (this.elements.refreshLogs) {
-        this.elements.refreshLogs.innerHTML = "Refresh";
+        this.elements.refreshLogs.textContent = "Refresh";
         this.elements.refreshLogs.disabled = false;
       }
     }
   }
 
+  createHtmlFragment(html) {
+    const fragment = document.createDocumentFragment();
+    if (!html) return fragment;
+
+    const parser = new DOMParser();
+    const parsed = parser.parseFromString(String(html), "text/html");
+    Array.from(parsed.body.childNodes).forEach((node) => {
+      fragment.appendChild(document.importNode(node, true));
+    });
+
+    return fragment;
+  }
+
+  setButtonIconAndLabel(button, iconName, label) {
+    if (!button) return;
+    const icon = document.createElement("span");
+    icon.className = "material-icons";
+    icon.textContent = iconName;
+    button.replaceChildren(icon, document.createTextNode(` ${label}`));
+  }
+
   async clearLogs() {
     const confirmed = await this.showConfirmDialog(
       "Clear All Logs",
@@ -3249,10 +3418,6 @@ class CheckOptions {
   }
 
   updateBrandingPreview() {
-    const companyName =
-      this.elements.companyName.value || this.brandingConfig.companyName;
-    const companyURL =
-      this.elements.companyURL.value || this.brandingConfig.companyURL;
     const productName =
       this.elements.productName.value || this.brandingConfig.productName;
     const primaryColor =
@@ -3566,8 +3731,93 @@ class CheckOptions {
       toggleIcon.textContent = "dark_mode";
     }
   }
+  
+  async viewDefaultDomains() {
+    try {
+      // Load detection rules to get default protected domains
+      const result = await chrome.storage.local.get(['detection_rules_cache']);
+      const cachedRules = result?.detection_rules_cache?.rules;
+      
+      let defaultDomains = [];
+      if (cachedRules && cachedRules.domain_squatting && cachedRules.domain_squatting.protected_domains) {
+        defaultDomains = cachedRules.domain_squatting.protected_domains;
+      } else {
+        // Fallback to loading from local file
+        const response = await fetch(chrome.runtime.getURL('rules/detection-rules.json'));
+        const rules = await response.json();
+        if (rules.domain_squatting && rules.domain_squatting.protected_domains) {
+          defaultDomains = rules.domain_squatting.protected_domains;
+        }
+      }
+      
+      if (defaultDomains.length === 0) {
+        this.showToast('No default protected domains found', 'warning');
+        return;
+      }
+      
+      // Show confirm dialog with default domains
+      const domainList = defaultDomains.map(d => `• ${d}`).join('\n');
+      const message = `Default Protected Domains (${defaultDomains.length}):\n\n${domainList}\n\nThese domains are protected by default. You can add additional domains in the "Protected Domains" field above.`;
+      
+      await this.showConfirmDialog(
+        'Default Protected Domains',
+        message
+      );
+    } catch (error) {
+      console.error('Failed to load default domains:', error);
+      this.showToast('Failed to load default protected domains', 'error');
+    }
+  }
+}
+
+// Minimal config summary: just show code-driven indicator count and key settings
+function renderConfigSummary(config) {
+  const codeDrivenDiv = document.getElementById('codeDrivenIndicators');
+  const keySettingsUl = document.getElementById('configKeySettings');
+  if (!config || !config.phishing_indicators) return;
+  // Show only code-driven indicator count
+  const codeDrivenCount = config.phishing_indicators.filter(r => r.code_driven).length;
+  const codeItem = document.createElement('div');
+  codeItem.className = 'config-item';
+  const codeLabel = document.createElement('strong');
+  codeLabel.textContent = 'Code-Driven Indicators:';
+  const codeValue = document.createElement('span');
+  codeValue.className = 'config-value';
+  codeValue.textContent = String(codeDrivenCount);
+  codeItem.appendChild(codeLabel);
+  codeItem.appendChild(document.createTextNode(' '));
+  codeItem.appendChild(codeValue);
+  codeDrivenDiv.replaceChildren(codeItem);
+  // Show some key settings
+  keySettingsUl.replaceChildren();
+  const appendSetting = (label, value) => {
+    const li = document.createElement('li');
+    const strong = document.createElement('strong');
+    strong.textContent = `${label}:`;
+    li.appendChild(strong);
+    li.appendChild(document.createTextNode(` ${value}`));
+    keySettingsUl.appendChild(li);
+  };
+  if (config.version) appendSetting('Rules Version', config.version);
+  if (config.lastUpdated) appendSetting('Last Updated', config.lastUpdated);
+  if (config.detection_settings && config.detection_settings.block_threshold !== undefined) {
+    appendSetting('Block Threshold', config.detection_settings.block_threshold);
+  }
+  if (config.detection_settings && config.detection_settings.warn_threshold !== undefined) {
+    appendSetting('Warn Threshold', config.detection_settings.warn_threshold);
+  }
 }
 
+// Patch into config loading logic
+(function() {
+  const origShowConfig = window.showConfigDisplay;
+  window.showConfigDisplay = function(config) {
+    if (typeof origShowConfig === 'function') origShowConfig(config);
+    renderConfigSummary(config);
+    document.getElementById('configSummary').style.display = '';
+  };
+})();
+
 // Initialize options page when DOM is loaded
 document.addEventListener("DOMContentLoaded", () => {
   window.checkOptions = new CheckOptions();
diff --git a/package.json b/package.json
index f954f1c..f639c87 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "Check",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "An open-source, Manifest V3 browser extension for detecting phishing attacks that impersonate Microsoft 365 sign-in pages.",
   "main": "index.js",
   "directories": {
diff --git a/popup/popup.html b/popup/popup.html
index 5fb452d..97ed1d9 100644
--- a/popup/popup.html
+++ b/popup/popup.html
@@ -220,7 +220,7 @@ <h3 class="section-title">Enterprise</h3>
           <a href="#" id="aboutLink" class="footer-link">About</a>
         </div>
         <div class="company-branding" id="companyBranding">
-          <span class="company-name" id="companyName"><a href="#" id="companyLink" class="footer-link">CyberDrain</a></span>
+          <span class="company-name" id="companyName">CyberDrain</span>
         </div>
       </footer>
     </div>
diff --git a/popup/popup.js b/popup/popup.js
index 7d841e6..e02cfef 100644
--- a/popup/popup.js
+++ b/popup/popup.js
@@ -67,7 +67,6 @@ class CheckPopup {
     this.elements.aboutLink = document.getElementById("aboutLink");
     this.elements.companyBranding = document.getElementById("companyBranding");
     this.elements.companyName = document.getElementById("companyName");
-    this.elements.companyLink = document.getElementById("companyLink");
 
     // Debug section
     this.elements.debugSection = document.getElementById("debugSection");
@@ -144,9 +143,6 @@ class CheckPopup {
     this.elements.aboutLink.addEventListener("click", (e) =>
       this.handleFooterLink(e, "about")
     );
-    this.elements.companyLink.addEventListener("click", (e) =>
-      this.handleFooterLink(e, "company")
-    );
 
     // Notification close listener
     this.elements.notificationClose.addEventListener("click", () =>
@@ -384,22 +380,22 @@ class CheckPopup {
       console.warn("Popup: Using fallback branding configuration");
       this.brandingConfig = {
         companyName: "CyberDrain",
-        companyURL: "https://cyberdrain.com/",
         productName: "Check",
         logoUrl: "images/icon32.png",
-        supportUrl: "https://support.cyberdrain.com",
-        privacyPolicyUrl: "https://cyberdrain.com/privacy",
+        supportUrl: "",
+        privacyPolicyUrl: "",
+        aboutUrl: "",
         primaryColor: "#F77F00",
       };
     } catch (error) {
       console.error("Error loading branding configuration:", error);
       this.brandingConfig = {
         companyName: "CyberDrain",
-        companyURL: "https://cyberdrain.com/",
         productName: "Check",
         logoUrl: "images/icon32.png",
-        supportUrl: "https://support.cyberdrain.com",
-        privacyPolicyUrl: "https://cyberdrain.com/privacy",
+        supportUrl: "",
+        privacyPolicyUrl: "",
+        aboutUrl: "",
         primaryColor: "#F77F00",
       };
     }
@@ -450,6 +446,9 @@ class CheckPopup {
     if (this.brandingConfig.privacyPolicyUrl) {
       this.elements.privacyLink.href = this.brandingConfig.privacyPolicyUrl;
     }
+    if (this.brandingConfig.aboutUrl) {
+      this.elements.aboutLink.href = this.brandingConfig.aboutUrl;
+    }
 
     // Apply primary color if available
     if (this.brandingConfig.primaryColor) {
@@ -1093,10 +1092,9 @@ class CheckPopup {
         url = this.brandingConfig.privacyPolicyUrl;
         break;
       case "about":
-        url = chrome.runtime.getURL("options/options.html#about");
-        break;
-      case "company":
-        url = this.brandingConfig.companyURL;
+        url =
+          this.brandingConfig.aboutUrl ||
+          chrome.runtime.getURL("options/options.html#about");
         break;
     }
 
@@ -1396,10 +1394,11 @@ class CheckPopup {
     if (isVisible) {
       // Hide the details
       this.elements.detectionResults.style.display = "none";
-      this.elements.showDetectionDetails.innerHTML = `
-        <span class="material-icons">visibility</span>
-        Show Details
-      `;
+      this.setButtonWithIcon(
+        this.elements.showDetectionDetails,
+        "visibility",
+        "Show Details"
+      );
       return;
     }
 
@@ -1408,10 +1407,11 @@ class CheckPopup {
       console.log("Re-displaying cached debug data for blocked page");
       this.displayDetectionDetails(this.cachedDebugData.detectionDetails);
       this.elements.detectionResults.style.display = "block";
-      this.elements.showDetectionDetails.innerHTML = `
-        <span class="material-icons">visibility_off</span>
-        Hide Details
-      `;
+      this.setButtonWithIcon(
+        this.elements.showDetectionDetails,
+        "visibility_off",
+        "Hide Details"
+      );
       return;
     }
 
@@ -1434,10 +1434,11 @@ class CheckPopup {
           if (response && response.success) {
             this.displayDetectionDetails(response.details);
             this.elements.detectionResults.style.display = "block";
-            this.elements.showDetectionDetails.innerHTML = `
-              <span class="material-icons">visibility_off</span>
-              Hide Details
-            `;
+            this.setButtonWithIcon(
+              this.elements.showDetectionDetails,
+              "visibility_off",
+              "Hide Details"
+            );
 
             // Store debug data for potential use if page gets blocked
             this.storeCurrentDebugData(response.details);
@@ -1477,10 +1478,20 @@ class CheckPopup {
       this.elements.m365Score.className = `detection-score ${scoreClass}`;
 
       if (foundElements && foundElements.length > 0) {
-        this.elements.m365Elements.innerHTML = `
-          <strong>Found:</strong> ${foundElements.join(", ")}<br>
-          <strong>Missing:</strong> ${missingElements.join(", ")}
-        `;
+        this.elements.m365Elements.textContent = "";
+        const foundLabel = document.createElement("strong");
+        foundLabel.textContent = "Found:";
+        this.elements.m365Elements.appendChild(foundLabel);
+        this.elements.m365Elements.appendChild(
+          document.createTextNode(` ${foundElements.join(", ")}`)
+        );
+        this.elements.m365Elements.appendChild(document.createElement("br"));
+        const missingLabel = document.createElement("strong");
+        missingLabel.textContent = "Missing:";
+        this.elements.m365Elements.appendChild(missingLabel);
+        this.elements.m365Elements.appendChild(
+          document.createTextNode(` ${(missingElements || []).join(", ")}`)
+        );
       } else {
         this.elements.m365Elements.textContent =
           "No Microsoft elements detected";
@@ -1568,18 +1579,16 @@ class CheckPopup {
 
     if (isVisible) {
       this.elements.sourceContent.style.display = "none";
-      this.elements.showPageSource.innerHTML = `
-        <span class="material-icons">code</span>
-        View Source
-      `;
+      this.setButtonWithIcon(this.elements.showPageSource, "code", "View Source");
     } else {
       if (this.pageSourceContent) {
         this.elements.sourceDisplay.textContent = this.pageSourceContent;
         this.elements.sourceContent.style.display = "block";
-        this.elements.showPageSource.innerHTML = `
-          <span class="material-icons">visibility_off</span>
-          Hide Source
-        `;
+        this.setButtonWithIcon(
+          this.elements.showPageSource,
+          "visibility_off",
+          "Hide Source"
+        );
       } else {
         this.showNotification("No page source available", "warning");
       }
@@ -1597,12 +1606,34 @@ class CheckPopup {
       searchTerm.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"),
       "gi"
     );
-    const highlightedContent = content.replace(
-      regex,
-      (match) => `<span class="source-highlight">${match}</span>`
-    );
 
-    this.elements.sourceDisplay.innerHTML = highlightedContent;
+    const fragment = document.createDocumentFragment();
+    let lastIndex = 0;
+    let match;
+
+    while ((match = regex.exec(content)) !== null) {
+      if (match.index > lastIndex) {
+        fragment.appendChild(
+          document.createTextNode(content.slice(lastIndex, match.index))
+        );
+      }
+
+      const highlight = document.createElement("span");
+      highlight.className = "source-highlight";
+      highlight.textContent = match[0];
+      fragment.appendChild(highlight);
+
+      lastIndex = regex.lastIndex;
+      if (match[0].length === 0) {
+        regex.lastIndex++;
+      }
+    }
+
+    if (lastIndex < content.length) {
+      fragment.appendChild(document.createTextNode(content.slice(lastIndex)));
+    }
+
+    this.elements.sourceDisplay.replaceChildren(fragment);
   }
 
   copySourceToClipboard() {
@@ -1634,17 +1665,19 @@ class CheckPopup {
 
     if (isVisible) {
       this.elements.consoleContent.style.display = "none";
-      this.elements.showConsoleLogs.innerHTML = `
-        <span class="material-icons">terminal</span>
-        View Logs
-      `;
+      this.setButtonWithIcon(
+        this.elements.showConsoleLogs,
+        "terminal",
+        "View Logs"
+      );
     } else {
       await this.loadConsoleLogs();
       this.elements.consoleContent.style.display = "block";
-      this.elements.showConsoleLogs.innerHTML = `
-        <span class="material-icons">visibility_off</span>
-        Hide Logs
-      `;
+      this.setButtonWithIcon(
+        this.elements.showConsoleLogs,
+        "visibility_off",
+        "Hide Logs"
+      );
     }
   }
 
@@ -1748,22 +1781,39 @@ class CheckPopup {
     this.elements.consoleStats.textContent = `${logs.length} log entries`;
 
     // Format and display logs
-    let formattedLogs = "";
-    logs.forEach((log, index) => {
+    const fragment = document.createDocumentFragment();
+    logs.forEach((log) => {
       const timestamp = new Date(log.timestamp).toLocaleTimeString();
-      const level = log.level || "log";
+      const level = (log.level || "log").toLowerCase();
+      const safeLevel = ["log", "info", "warn", "error", "debug"].includes(
+        level
+      )
+        ? level
+        : "log";
       const message = log.message || "";
 
-      formattedLogs += `<div class="console-entry">`;
-      formattedLogs += `<span class="console-timestamp">${timestamp}</span>`;
-      formattedLogs += `<span class="console-level ${level}">[${level.toUpperCase()}]</span>`;
-      formattedLogs += `<span class="console-message">${this.escapeHtml(
-        message
-      )}</span>`;
-      formattedLogs += `</div>`;
+      const entry = document.createElement("div");
+      entry.className = "console-entry";
+
+      const timestampEl = document.createElement("span");
+      timestampEl.className = "console-timestamp";
+      timestampEl.textContent = timestamp;
+
+      const levelEl = document.createElement("span");
+      levelEl.className = `console-level ${safeLevel}`;
+      levelEl.textContent = `[${safeLevel.toUpperCase()}]`;
+
+      const messageEl = document.createElement("span");
+      messageEl.className = "console-message";
+      messageEl.textContent = String(message);
+
+      entry.appendChild(timestampEl);
+      entry.appendChild(levelEl);
+      entry.appendChild(messageEl);
+      fragment.appendChild(entry);
     });
 
-    this.elements.consoleDisplay.innerHTML = formattedLogs;
+    this.elements.consoleDisplay.replaceChildren(fragment);
     this.consoleLogsContent = logs
       .map(
         (log) =>
@@ -1777,7 +1827,7 @@ class CheckPopup {
   searchInConsoleLogs(searchTerm) {
     if (!this.consoleLogsContent || !searchTerm.trim()) {
       // Restore original display if search is cleared
-      if (this.elements.consoleDisplay.innerHTML.includes("console-entry")) {
+      if (this.elements.consoleDisplay.querySelector(".console-entry")) {
         return; // Already displaying formatted logs
       }
       return;
@@ -1826,6 +1876,14 @@ class CheckPopup {
     return div.innerHTML;
   }
 
+  setButtonWithIcon(button, iconName, label) {
+    if (!button) return;
+    const icon = document.createElement("span");
+    icon.className = "material-icons";
+    icon.textContent = iconName;
+    button.replaceChildren(icon, document.createTextNode(` ${label}`));
+  }
+
   // Debug Data Storage Methods
   async storeCurrentDebugData(detectionDetails = null) {
     if (!this.currentTab || !this.currentTab.url || this.isBlockedRoute) {
@@ -1874,68 +1932,115 @@ class CheckPopup {
 
   async getStoredDebugDataForUrl(url) {
     try {
-      const storageKey = `debug_data_${btoa(url).substring(0, 50)}`;
+      const normalizeUrl = (inputUrl) => {
+        try {
+          const parsed = new URL(inputUrl);
+          parsed.hash = "";
+          return parsed.toString();
+        } catch {
+          return inputUrl;
+        }
+      };
 
-      // For blocked pages, use background script communication since content scripts don't work
-      if (this.isBlockedRoute) {
+      const canonicalUrl = (inputUrl) => {
         try {
-          console.log("Requesting debug data with key:", storageKey);
-          const response = await chrome.runtime.sendMessage({
-            type: "GET_STORED_DEBUG_DATA",
-            key: storageKey,
-          });
+          const parsed = new URL(inputUrl);
+          const host = parsed.hostname.replace(/^www\./i, "").toLowerCase();
+          const path = (parsed.pathname || "/").replace(/\/$/, "") || "/";
+          const search = parsed.search || "";
+          return `${host}${path}${search}`;
+        } catch {
+          return inputUrl;
+        }
+      };
+
+      const buildVariantKeys = (inputUrl) => {
+        const variants = new Set();
+        const addKey = (u) => {
+          try {
+            variants.add(`debug_data_${btoa(u).substring(0, 50)}`);
+          } catch {
+            // Ignore malformed URL variant
+          }
+        };
 
-          console.log("Background script response:", response);
+        const normalized = normalizeUrl(inputUrl);
+        addKey(normalized);
 
-          if (response && response.success && response.debugData) {
-            const data = response.debugData;
-            console.log("Retrieved data structure:", data);
-            console.log("Data has timestamp:", !!data.timestamp);
-            console.log("Data has debugData:", !!data.debugData);
+        try {
+          const parsed = new URL(normalized);
+          const pathAndQuery = `${parsed.pathname || "/"}${parsed.search || ""}`;
 
-            // Check if data is not too old (1 hour)
-            const oneHour = 60 * 60 * 1000;
-            if (data.timestamp && Date.now() - data.timestamp < oneHour) {
-              console.log(
-                "Retrieved stored debug data via background script for URL:",
-                url
-              );
-              console.log("Returning debug data:", data.debugData);
-              return data.debugData; // Return the nested debugData object
-            } else {
-              console.log("Data too old or no timestamp, cleaning up");
-              // Clean up old data
-              await chrome.storage.local.remove([storageKey]);
-            }
+          const withSlashPath = pathAndQuery.endsWith("/")
+            ? pathAndQuery
+            : `${pathAndQuery}/`;
+          const withoutSlashPath = pathAndQuery.replace(/\/$/, "") || "/";
+
+          addKey(`${parsed.protocol}//${parsed.host}${withSlashPath}`);
+          addKey(`${parsed.protocol}//${parsed.host}${withoutSlashPath}`);
+
+          if (parsed.hostname.startsWith("www.")) {
+            addKey(
+              `${parsed.protocol}//${parsed.hostname.slice(4)}${pathAndQuery}`
+            );
           } else {
-            console.log("No valid response or missing debugData");
+            addKey(`${parsed.protocol}//www.${parsed.hostname}${pathAndQuery}`);
           }
-          return null;
-        } catch (error) {
-          console.error(
-            "Failed to retrieve debug data via background script:",
-            error
-          );
-          return null;
+
+          const swappedProtocol = parsed.protocol === "https:" ? "http:" : "https:";
+          addKey(`${swappedProtocol}//${parsed.host}${pathAndQuery}`);
+        } catch {
+          // Ignore parse errors - normalized variant already added
         }
-      } else {
-        // For regular pages, use direct storage access
-        const result = await chrome.storage.local.get([storageKey]);
-        const data = result[storageKey];
-
-        if (data && data.debugData) {
-          // Check if data is not too old (1 hour)
-          const oneHour = 60 * 60 * 1000;
-          if (Date.now() - data.timestamp < oneHour) {
-            console.log("Retrieved stored debug data for URL:", url);
-            return data.debugData;
-          } else {
-            // Clean up old data
-            await chrome.storage.local.remove([storageKey]);
+
+        return [...variants];
+      };
+
+      const oneHour = 60 * 60 * 1000;
+      const targetCanonical = canonicalUrl(url);
+      const variantKeys = buildVariantKeys(url);
+
+      // Fast path: check deterministic key variants first.
+      if (variantKeys.length > 0) {
+        const directResult = await chrome.storage.local.get(variantKeys);
+
+        for (const key of variantKeys) {
+          const data = directResult[key];
+          if (!data || !data.debugData) continue;
+
+          const ageValid = data.timestamp && Date.now() - data.timestamp < oneHour;
+          if (!ageValid) {
+            await chrome.storage.local.remove([key]);
+            continue;
           }
+
+          console.log("Retrieved stored debug data via key variant:", key);
+          return data.debugData;
         }
-        return null;
       }
+
+      // Fallback path: scan debug_data_* keys and match by canonical stored URL.
+      const allStorage = await chrome.storage.local.get(null);
+      const candidates = Object.entries(allStorage)
+        .filter(([key, value]) => key.startsWith("debug_data_") && value && value.debugData)
+        .map(([key, value]) => ({ key, value }));
+
+      const matched = candidates
+        .filter(({ value }) => {
+          if (!value.url) return false;
+          if (!value.timestamp || Date.now() - value.timestamp >= oneHour) {
+            return false;
+          }
+          return canonicalUrl(value.url) === targetCanonical;
+        })
+        .sort((a, b) => (b.value.timestamp || 0) - (a.value.timestamp || 0));
+
+      if (matched.length > 0) {
+        console.log("Retrieved stored debug data via canonical URL fallback:", matched[0].key);
+        return matched[0].value.debugData;
+      }
+
+      return null;
     } catch (error) {
       console.error("Failed to retrieve debug data:", error);
       return null;
diff --git a/rules/detection-rules.json b/rules/detection-rules.json
index a8bdeac..13d0558 100644
--- a/rules/detection-rules.json
+++ b/rules/detection-rules.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.1.0",
+  "version": "1.2.0",
   "lastUpdated": "2025-12-20T00:00:00Z",
   "description": "Phishing detection logic for identifying phishing attempts targeting Microsoft 365 login pages",
   "trusted_login_patterns": [
@@ -33,7 +33,11 @@
     "^https:\\/\\/([a-zA-Z0-9-]+\\.)*microsoftazuread-sso\\.com$",
     "^https:\\/\\/([a-zA-Z0-9-]+\\.)*azureedge\\.net$",
     "^https:\\/\\/([a-zA-Z0-9-]+\\.)*bing\\.com$",
+    "^https:\\/\\/([a-zA-Z0-9-]+\\.)*msn\\.com$",
+    "^https:\\/\\/([a-zA-Z0-9-]+\\.)*xbox\\.com$",
+    "^https:\\/\\/([a-zA-Z0-9-]+\\.)*mcas\\.ms$",
     "^https:\\/\\/github\\.com$",
+    "^https:\\/\\/raw\\.githubusercontent\\.com$",
     "^https:\\/\\/([a-zA-Z0-9-]+\\.)*cloud\\.microsoft$",
     "^https:\\/\\/([a-zA-Z0-9-]+\\.)*powerbi\\.com$"
   ],
@@ -178,11 +182,7 @@
         "id": "meta_og_title_microsoft",
         "type": "meta_tag",
         "attribute": "og:title",
-        "patterns": [
-          "microsoft",
-          "office\\s*365",
-          "azure"
-        ],
+        "patterns": ["microsoft", "office\\s*365", "azure"],
         "description": "Open Graph title contains Microsoft branding",
         "weight": 0.5,
         "category": "secondary"
@@ -221,19 +221,73 @@
       },
       {
         "id": "segoe_ui_font",
-        "type": "source_content",
-        "pattern": "Segoe\\s+UI(?:\\s+(?:Webfont|Symbol|Historic|Emoji))?",
+        "type": "code_driven",
+        "code_logic": {
+          "type": "all_of",
+          "operations": [
+            {
+              "type": "substring_present",
+              "values": ["segoe ui"]
+            },
+            {
+              "type": "any_of",
+              "operations": [
+                {
+                  "type": "substring_present",
+                  "values": [
+                    "loginfmt",
+                    "idsibutton9",
+                    "idpartnerpl",
+                    "urlmsasignup",
+                    "aadcdn.msauth.net",
+                    "aadcdn.msftauthimages.net"
+                  ]
+                },
+                {
+                  "type": "substring_present",
+                  "values": ["type=\"password\"", "signin", "sign in", "login"]
+                }
+              ]
+            }
+          ]
+        },
         "description": "Microsoft's Segoe UI font family variants (supporting evidence only)",
         "weight": 0.5,
         "category": "secondary"
       },
       {
         "id": "ms_container_layout",
-        "type": "css_pattern",
-        "patterns": [
-          "display:\\s*grid.*place-items:\\s*center",
-          "height:\\s*100vh.*width:\\s*100vw"
-        ],
+        "type": "code_driven",
+        "code_logic": {
+          "type": "any_of",
+          "operations": [
+            {
+              "type": "pattern_count",
+              "patterns": [
+                "display:\\s*grid[^;{}]*;[^{}]*place-items:\\s*center"
+              ],
+              "flags": "i",
+              "min_count": 1
+            },
+            {
+              "type": "all_of",
+              "operations": [
+                {
+                  "type": "pattern_count",
+                  "patterns": ["(?:^|[^-\\w])height\\s*:\\s*100vh\\s*;"],
+                  "flags": "i",
+                  "min_count": 1
+                },
+                {
+                  "type": "pattern_count",
+                  "patterns": ["(?:^|[^-\\w])width\\s*:\\s*100vw\\s*;"],
+                  "flags": "i",
+                  "min_count": 1
+                }
+              ]
+            }
+          ]
+        },
         "description": "Microsoft login container layout (supporting evidence only)",
         "weight": 0.5,
         "category": "secondary"
@@ -241,7 +295,7 @@
       {
         "id": "ms_external_css",
         "type": "source_content",
-        "pattern": "(?:href=[\"'].*(?:aadcdn\\.msauth|aadcdn\\.msftauth|login\\.microsoftonline).*\\.css[\"']|src=[\"'].*(?:aadcdn\\.msauth|login\\.microsoft).*\\.css[\"'])",
+        "pattern": "(?:<(?:link|script)[^>]+(?:href|src)=[\"']https?:\\/\\/[^\"']*(?:aadcdn\\.msauth\\.net|aadcdn\\.msftauth\\.net|aadcdn\\.msftauthimages\\.net|login\\.microsoftonline\\.com)[^\"']*\\.css(?:\\?[^\"']*)?[\"'][^>]*>)",
         "description": "Microsoft login-specific CSS files (strong evidence)",
         "weight": 3,
         "category": "secondary"
@@ -343,26 +397,19 @@
   "aad_detection_elements": [
     {
       "id": "loginfmt_field",
-      "selectors": [
-        "input[name='loginfmt']",
-        "#i0116"
-      ],
+      "selectors": ["input[name='loginfmt']", "#i0116"],
       "description": "Azure AD username/email input field",
       "weight": 30
     },
     {
       "id": "next_button",
-      "selectors": [
-        "#idSIButton9"
-      ],
+      "selectors": ["#idSIButton9"],
       "description": "Azure AD Next/Sign in button",
       "weight": 25
     },
     {
       "id": "password_field",
-      "selectors": [
-        "input[type='password']"
-      ],
+      "selectors": ["input[type='password']"],
       "description": "Password input field",
       "weight": 20
     },
@@ -392,25 +439,19 @@
     },
     {
       "id": "urlMsaSignUp",
-      "text_patterns": [
-        "urlMsaSignUp"
-      ],
+      "text_patterns": ["urlMsaSignUp"],
       "description": "Microsoft signup URL reference",
       "weight": 15
     },
     {
       "id": "flowToken",
-      "text_patterns": [
-        "flowToken"
-      ],
+      "text_patterns": ["flowToken"],
       "description": "Microsoft authentication flow token",
       "weight": 15
     },
     {
       "id": "aadcdn_msauth",
-      "text_patterns": [
-        "https:\\/\\/aadcdn\\.msauth\\.net/"
-      ],
+      "text_patterns": ["https:\\/\\/aadcdn\\.msauth\\.net/"],
       "description": "Microsoft authentication CDN reference",
       "weight": 15
     }
@@ -421,9 +462,7 @@
       "type": "url",
       "weight": 25,
       "condition": {
-        "domains": [
-          "login.microsoftonline.com"
-        ]
+        "domains": ["login.microsoftonline.com"]
       },
       "description": "Verify legitimate Microsoft domain (must be login.microsoftonline.com)"
     },
@@ -475,10 +514,7 @@
       "type": "dom",
       "weight": 20,
       "condition": {
-        "selectors": [
-          "input[name='loginfmt']",
-          "#i0116"
-        ]
+        "selectors": ["input[name='loginfmt']", "#i0116"]
       },
       "description": "Check for loginfmt input field availability"
     },
@@ -610,11 +646,7 @@
           },
           {
             "type": "substring_present",
-            "values": [
-              "microsoft",
-              "office",
-              "365"
-            ]
+            "values": ["microsoft", "office", "365"]
           }
         ]
       },
@@ -650,9 +682,7 @@
       "code_logic": {
         "type": "resource_from_domain",
         "resource_type": "customcss",
-        "allowed_domains": [
-          "aadcdn.msftauthimages.net"
-        ],
+        "allowed_domains": ["aadcdn.msftauthimages.net"],
         "invert": true
       },
       "severity": "high",
@@ -672,33 +702,21 @@
             "operations": [
               {
                 "type": "substring_present",
-                "values": [
-                  "microsoft",
-                  "office",
-                  "365"
-                ]
+                "values": ["microsoft", "office", "365"]
               },
               {
                 "type": "substring_present",
-                "values": [
-                  "login",
-                  "password",
-                  "signin"
-                ]
+                "values": ["login", "password", "signin"]
               },
               {
                 "type": "pattern_count",
-                "patterns": [
-                  "<form[^>]*action"
-                ],
+                "patterns": ["<form[^>]*action"],
                 "flags": "i",
                 "min_count": 1
               },
               {
                 "type": "has_but_not",
-                "required": [
-                  "action"
-                ],
+                "required": ["action"],
                 "prohibited": [
                   "login.microsoftonline.com",
                   ".auth/login/",
@@ -748,21 +766,13 @@
         "operations": [
           {
             "type": "substring_count",
-            "substrings": [
-              "loginfmt",
-              "i0116",
-              "idSIButton9"
-            ],
+            "substrings": ["loginfmt", "i0116", "idSIButton9"],
             "min_count": 2
           },
           {
             "type": "has_but_not",
-            "required": [
-              "password"
-            ],
-            "prohibited": [
-              "login.microsoftonline.com"
-            ]
+            "required": ["password"],
+            "prohibited": ["login.microsoftonline.com"]
           }
         ]
       },
@@ -793,24 +803,15 @@
             "operations": [
               {
                 "type": "substring_present",
-                "values": [
-                  "microsoft",
-                  "office",
-                  "365"
-                ]
+                "values": ["microsoft", "office", "365"]
               },
               {
                 "type": "substring_present",
-                "values": [
-                  "password",
-                  "passwd"
-                ]
+                "values": ["password", "passwd"]
               },
               {
                 "type": "form_action_check",
-                "required_domains": [
-                  "login.microsoftonline.com"
-                ]
+                "required_domains": ["login.microsoftonline.com"]
               }
             ]
           },
@@ -913,7 +914,7 @@
               "event.shiftKey",
               "event.keyCode"
             ],
-            "min_matches": 2
+            "min_matches": 5
           },
           {
             "type": "not_if_contains",
@@ -981,7 +982,7 @@
                   "String.fromCharCode",
                   "fromCharCode"
                 ],
-                "min_matches": 1
+                "min_matches": 3
               },
               {
                 "type": "substring_present",
@@ -1044,17 +1045,25 @@
       "id": "phi_019_malicious_obfuscation",
       "code_driven": true,
       "code_logic": {
-        "type": "substring_or_regex",
-        "substrings": [
-          "atob(",
-          "unescape(",
-          "eval(",
-          ".split('')",
-          ".reverse()",
-          "String.fromCharCode("
-        ],
-        "regex": "(?:(?:var|let|const)\\s+\\w+\\s*=\\s*(?:atob|unescape)\\([^)]+\\);\\s*eval\\(\\w+\\)|\\w+\\.split\\(['\"]['\"]\\)\\.reverse\\(\\)\\.join\\(['\"]['\"]\\)|String\\.fromCharCode\\((?:\\d+,\\s*){10,}\\d+\\))",
-        "flags": "i"
+        "type": "all_of",
+        "operations": [
+          {
+            "type": "obfuscation_check",
+            "indicators": [
+              "atob(",
+              "unescape(",
+              "eval(",
+              ".split('')",
+              ".reverse()",
+              "String.fromCharCode("
+            ],
+            "min_matches": 2
+          },
+          {
+            "type": "substring_present",
+            "values": ["eval(", "atob(", "unescape(", "String.fromCharCode("]
+          }
+        ]
       },
       "pattern": "(?:(?:var|let|const)\\s+\\w+\\s*=\\s*(?:atob|unescape)\\([^)]+\\);\\s*eval\\(\\w+\\)|\\w+\\.split\\(['\"]['\"]\\)\\.reverse\\(\\)\\.join\\(['\"]['\"]\\)|String\\.fromCharCode\\((?:\\d+,\\s*){10,}\\d+\\))",
       "flags": "i",
@@ -1131,13 +1140,7 @@
             "operations": [
               {
                 "type": "substring_present",
-                "values": [
-                  "microsoft",
-                  "office",
-                  "365",
-                  "outlook",
-                  "azure"
-                ]
+                "values": ["microsoft", "office", "365", "outlook", "azure"]
               },
               {
                 "type": "any_of",
@@ -1188,11 +1191,7 @@
               },
               {
                 "type": "has_but_not",
-                "required": [
-                  "team",
-                  "department",
-                  "support"
-                ],
+                "required": ["team", "department", "support"],
                 "prohibited": [
                   "sign in with microsoft",
                   "continue with microsoft",
@@ -1250,164 +1249,95 @@
             "type": "multi_proximity",
             "pairs": [
               {
-                "words": [
-                  "verify",
-                  "account"
-                ],
+                "words": ["verify", "account"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "verify",
-                  "information"
-                ],
+                "words": ["verify", "information"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "verify",
-                  "identity"
-                ],
+                "words": ["verify", "identity"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "suspended",
-                  "365"
-                ],
+                "words": ["suspended", "365"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "suspended",
-                  "account"
-                ],
+                "words": ["suspended", "account"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "suspended",
-                  "office"
-                ],
+                "words": ["suspended", "office"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "update",
-                  "office"
-                ],
+                "words": ["update", "office"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "update",
-                  "microsoft"
-                ],
+                "words": ["update", "microsoft"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "update",
-                  "365"
-                ],
+                "words": ["update", "365"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "secure",
-                  "microsoft"
-                ],
+                "words": ["secure", "microsoft"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "secure",
-                  "account"
-                ],
+                "words": ["secure", "account"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "account",
-                  "security"
-                ],
+                "words": ["account", "security"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "security",
-                  "verification"
-                ],
+                "words": ["security", "verification"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "security",
-                  "alert"
-                ],
+                "words": ["security", "alert"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "login",
-                  "microsoft"
-                ],
+                "words": ["login", "microsoft"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "microsoft",
-                  "login"
-                ],
+                "words": ["microsoft", "login"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "microsoft",
-                  "authentication"
-                ],
+                "words": ["microsoft", "authentication"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "authentication",
-                  "microsoft"
-                ],
+                "words": ["authentication", "microsoft"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "office",
-                  "365"
-                ],
+                "words": ["office", "365"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "365",
-                  "login"
-                ],
+                "words": ["365", "login"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "office",
-                  "login"
-                ],
+                "words": ["office", "login"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "365",
-                  "suspended"
-                ],
+                "words": ["365", "suspended"],
                 "max_distance": 50
               },
               {
-                "words": [
-                  "office",
-                  "suspended"
-                ],
+                "words": ["office", "suspended"],
                 "max_distance": 50
               }
             ]
@@ -1505,34 +1435,22 @@
                 "type": "multi_proximity",
                 "pairs": [
                   {
-                    "words": [
-                      "microsoft",
-                      "login"
-                    ],
+                    "words": ["microsoft", "login"],
                     "max_distance": 750
                   },
                   {
-                    "words": [
-                      "office",
-                      "sign in"
-                    ],
+                    "words": ["office", "sign in"],
                     "max_distance": 750
                   },
                   {
-                    "words": [
-                      "365",
-                      "authentication"
-                    ],
+                    "words": ["365", "authentication"],
                     "max_distance": 750
                   }
                 ]
               },
               {
                 "type": "has_but_not",
-                "required": [
-                  "login",
-                  "sign"
-                ],
+                "required": ["login", "sign"],
                 "prohibited": [
                   "sign in with microsoft",
                   "continue with microsoft",
@@ -1640,10 +1558,7 @@
       "code_driven": true,
       "code_logic": {
         "type": "pattern_count",
-        "patterns": [
-          "(?:<b></b>){5,}",
-          "(?:<i></i>){5,}"
-        ],
+        "patterns": ["(?:<b></b>){5,}", "(?:<i></i>){5,}"],
         "flags": "i",
         "min_count": 1
       },
@@ -1872,9 +1787,7 @@
         "action": "warn",
         "category": "code_obfuscation",
         "confidence": 0.7,
-        "context_required": [
-          "(?:atob|eval|innerHTML|document\\.write)"
-        ]
+        "context_required": ["(?:atob|eval|innerHTML|document\\.write)"]
       },
       {
         "id": "phi_022_cross_origin_fullscreen_iframe",
@@ -1909,9 +1822,7 @@
       {
         "id": "validate_css_origin",
         "pattern": "customcss",
-        "required_origins": [
-          "aadcdn.msftauthimages.net"
-        ],
+        "required_origins": ["aadcdn.msftauthimages.net"],
         "action": "block",
         "description": "Custom CSS must come from Microsoft CDN"
       }
@@ -1928,5 +1839,52 @@
     "log_matches": true,
     "auto_update": true,
     "fallback_on_error": true
+  },
+  "domain_squatting": {
+    "description": "Domain squatting detection configuration to protect against typosquatting, homoglyphs, and combosquatting attacks",
+    "action": "block",
+    "deviation_threshold": 2,
+    "algorithms": {
+      "levenshtein": true,
+      "homoglyph": true,
+      "typosquat": true,
+      "combosquat": true
+    },
+    "protected_domains": [
+      "microsoft.com",
+      "microsoftonline.com",
+      "office.com",
+      "office365.com",
+      "outlook.com",
+      "hotmail.com",
+      "live.com",
+      "onedrive.com",
+      "sharepoint.com",
+      "azure.com",
+      "windows.com",
+      "xbox.com",
+      "skype.com",
+      "linkedin.com",
+      "github.com",
+      "google.com",
+      "gmail.com",
+      "facebook.com",
+      "twitter.com",
+      "instagram.com",
+      "amazon.com",
+      "apple.com",
+      "paypal.com",
+      "netflix.com",
+      "dropbox.com",
+      "salesforce.com",
+      "adobe.com",
+      "zoom.us",
+      "slack.com",
+      "atlassian.com",
+      "shopify.com",
+      "githubusercontent.com"
+    ],
+    "severity": "high",
+    "log_detections": true
   }
 }
diff --git a/scripts/background.js b/scripts/background.js
index 8d50fe8..20db576 100644
--- a/scripts/background.js
+++ b/scripts/background.js
@@ -11,6 +11,7 @@ import { ConfigManager } from "./modules/config-manager.js";
 import { PolicyManager } from "./modules/policy-manager.js";
 import { DetectionRulesManager } from "./modules/detection-rules-manager.js";
 import { WebhookManager } from "./modules/webhook-manager.js";
+import { DomainSquattingDetector } from "./modules/domain-squatting-detector.js";
 import logger from "./utils/logger.js";
 import { store as storeLog } from "./utils/background-logger.js";
 
@@ -288,8 +289,9 @@ class CheckBackground {
   constructor() {
     this.configManager = new ConfigManager();
     this.policyManager = new PolicyManager();
-    this.detectionRulesManager = new DetectionRulesManager();
+    this.detectionRulesManager = new DetectionRulesManager(this.configManager);
     this.rogueAppsManager = new RogueAppsManager();
+    this.domainSquattingDetector = new DomainSquattingDetector();
     this.webhookManager = new WebhookManager(this.configManager);
     this.isInitialized = false;
     this.initializationPromise = null;
@@ -398,6 +400,17 @@ class CheckBackground {
 
       // Initialize detection rules manager
       await this.detectionRulesManager.initialize();
+      
+      // Initialize domain squatting detector with rules and URL allowlist
+      const detectionRules = this.detectionRulesManager.cachedRules;
+      if (detectionRules) {
+        const runtimeConfig = await this.configManager.getConfig();
+        await this.domainSquattingDetector.initialize(
+          detectionRules,
+          runtimeConfig
+        );
+        logger.log("Domain squatting detector initialized");
+      }
 
       await this.refreshPolicy();
 
@@ -1411,6 +1424,17 @@ class CheckBackground {
               rules,
               message: "Detection rules updated",
             });
+            
+            // Also update domain squatting detector with new rules and URL allowlist
+            const updatedRules = await this.detectionRulesManager.getDetectionRules();
+            if (updatedRules && this.domainSquattingDetector) {
+              const runtimeConfig = await this.configManager.getConfig();
+              await this.domainSquattingDetector.initialize(
+                updatedRules,
+                runtimeConfig
+              );
+              logger.log("Domain squatting detector updated with new rules");
+            }
           } catch (error) {
             logger.error(
               "Check: Failed to force update detection rules:",
@@ -1419,6 +1443,42 @@ class CheckBackground {
             sendResponse({ success: false, error: error.message });
           }
           break;
+        
+        case "check_domain_squatting":
+          try {
+            const { domain } = message;
+            if (!domain) {
+              sendResponse({ success: false, error: "Domain parameter required" });
+              break;
+            }
+            
+            const result = this.domainSquattingDetector.checkDomain(domain);
+            sendResponse({ success: true, result });
+          } catch (error) {
+            logger.error("Check: Failed to check domain squatting:", error);
+            sendResponse({ success: false, error: error.message });
+          }
+          break;
+
+        case "REDIRECT_TO_BLOCKED_PAGE":
+          try {
+            if (!sender.tab?.id) {
+              sendResponse({ success: false, error: "No tab ID available" });
+              break;
+            }
+
+            if (!message.url) {
+              sendResponse({ success: false, error: "No redirect URL provided" });
+              break;
+            }
+
+            await chrome.tabs.update(sender.tab.id, { url: message.url });
+            sendResponse({ success: true });
+          } catch (error) {
+            logger.error("Check: Failed to redirect tab to blocked page:", error);
+            sendResponse({ success: false, error: error.message });
+          }
+          break;
 
         case "UPDATE_CONFIG":
           try {
@@ -1440,6 +1500,17 @@ class CheckBackground {
               updatedConfig?.enableValidPageBadge ||
               this.policy?.EnableValidPageBadge;
 
+            // Update domain squatting detector with new configuration
+            // If URL allowlist changed, reinitialize detector to extract new domains
+            if (this.domainSquattingDetector) {
+              const detectionRules = this.detectionRulesManager.cachedRules || {};
+              await this.domainSquattingDetector.initialize(
+                detectionRules,
+                updatedConfig
+              );
+              logger.log("Domain squatting detector configuration updated");
+            }
+
             // If badge was disabled, remove badges from all tabs
             if (previousBadgeEnabled && !newBadgeEnabled) {
               logger.log(
@@ -1798,8 +1869,9 @@ class CheckBackground {
         enhancedEvent.threatDetected = true;
         break;
       case "threat_detected":
-        enhancedEvent.action = event.action || "blocked";
-        enhancedEvent.threatLevel = event.threatLevel || "high";
+        enhancedEvent.action = event.action || "warned";
+        enhancedEvent.threatLevel =
+          event.threatLevel || event.severity || "medium";
         enhancedEvent.threatDetected = true;
         break;
       case "form_submission":
diff --git a/scripts/blocked.js b/scripts/blocked.js
index a998c31..0ae0cae 100644
--- a/scripts/blocked.js
+++ b/scripts/blocked.js
@@ -25,7 +25,8 @@ function parseUrlParams() {
 
   if (detailsParam) {
     try {
-      const details = JSON.parse(decodeURIComponent(detailsParam));
+      // URLSearchParams.get() already decodes the URI component, so don't decode again
+      const details = JSON.parse(detailsParam);
       console.log("Parsed details:", details);
       
       // Store details globally for false positive reporting
@@ -50,8 +51,15 @@ function parseUrlParams() {
         document.getElementById("blockReason").textContent = details.reason;
       }
 
-      // Update threat category based on rule description or score
-      if (details.ruleDescription) {
+      // Update threat category based on type or rule description
+      if (details.type === "domain_squatting") {
+        document.getElementById("threatCategory").textContent = "Domain Squatting";
+        // Custom messaging for domain squatting
+        if (details.protectedDomain) {
+          document.getElementById("blockReason").textContent = 
+            `This website's domain closely resembles "${details.protectedDomain}" but is NOT the legitimate site. Entering your credentials here could compromise your account.`;
+        }
+      } else if (details.ruleDescription) {
         document.getElementById("threatCategory").textContent =
           details.ruleDescription;
       } else if (details.rule) {
@@ -750,14 +758,67 @@ function toggleTechnicalDetails() {
 window.toggleTechnicalDetails = toggleTechnicalDetails;
 
 // Populate technical details from parsed data
+function setSeverityBadge(severityElement, severityClass, severityText) {
+  if (!severityElement) return;
+  const badge = document.createElement("span");
+  badge.className = `tech-badge ${severityClass || "high"}`;
+  badge.textContent = severityText;
+  severityElement.replaceChildren(badge);
+}
+
 function populateTechnicalDetails(details) {
   console.log("=== POPULATING TECHNICAL DETAILS ===");
   console.log("Full details object:", details);
   console.log("Details.threats:", details.threats);
   console.log("Details.phishingIndicators:", details.phishingIndicators);
   console.log("Details.foundIndicators:", details.foundIndicators);
+  console.log("Details.type:", details.type);
+
+  // Handle domain squatting specific details
+  if (details.type === "domain_squatting") {
+    console.log("Populating domain squatting details");
+    
+    // Detection Scores - use confidence for domain squatting
+    if (details.confidence !== undefined) {
+      document.getElementById("techScore").textContent = `${Math.round(details.confidence * 100)}%`;
+    }
+    document.getElementById("techThreshold").textContent = "Domain Similarity";
+    
+    // Threat Analysis - use techniques
+    let indicatorCount = 0;
+    if (details.techniques && Array.isArray(details.techniques)) {
+      indicatorCount = details.techniques.length;
+      document.getElementById("techIndicatorCount").textContent = indicatorCount;
+      
+      // Set severity
+      const severityElement = document.getElementById("techSeverity");
+      const severityMap = { critical: "CRITICAL", high: "HIGH", medium: "MEDIUM", low: "LOW" };
+      const severityText = severityMap[details.severity] || details.severity.toUpperCase();
+      setSeverityBadge(severityElement, details.severity, severityText);
+      
+      // Populate techniques as indicators
+      populatePhishingIndicatorsList(details.techniques, details);
+    }
+    
+    // Detection method
+    document.getElementById("techDetectionMethod").textContent = "Domain Squatting Detection";
+    
+    // Page Information
+    if (details.testDomain) {
+      document.getElementById("techPageTitle").textContent = `Suspicious Domain: ${details.testDomain}`;
+    }
+    if (details.protectedDomain) {
+      const userAgent = document.getElementById("techUserAgent");
+      userAgent.textContent = `Impersonating: ${details.protectedDomain}`;
+    }
+    document.getElementById("techTimestamp").textContent = details.detectionTime 
+      ? new Date(details.detectionTime).toLocaleString() 
+      : new Date().toLocaleString();
+    
+    return; // Exit early for domain squatting
+  }
 
-  // Detection Scores
+  // Detection Scores for phishing detection
   if (details.score !== undefined) {
     document.getElementById("techScore").textContent = details.score;
   }
@@ -765,7 +826,7 @@ function populateTechnicalDetails(details) {
     document.getElementById("techThreshold").textContent = details.threshold;
   }
 
-  // Threat Analysis - Use multiple data sources
+  // Threat Analysis - Use multiple data sources for phishing
   let phishingIndicators = [];
   let indicatorCount = 0;
 
@@ -844,13 +905,17 @@ function populateTechnicalDetails(details) {
         (severityOrder[a] || 0) > (severityOrder[b] || 0) ? a : b
       );
       const severityElement = document.getElementById("techSeverity");
-      severityElement.innerHTML = `<span class="tech-badge ${highestSeverity}">${highestSeverity.toUpperCase()}</span>`;
+      setSeverityBadge(
+        severityElement,
+        highestSeverity,
+        highestSeverity.toUpperCase()
+      );
       console.log("Highest severity set to:", highestSeverity);
     } else {
       // Fallback: if we have threats but no severity, assume "high" based on the fact it was blocked
       if (indicatorCount > 0) {
         const severityElement = document.getElementById("techSeverity");
-        severityElement.innerHTML = `<span class="tech-badge high">HIGH</span>`;
+        setSeverityBadge(severityElement, "high", "HIGH");
         console.log("Set fallback severity to HIGH");
       }
     }
@@ -889,6 +954,7 @@ function populateTechnicalDetails(details) {
 function populatePhishingIndicatorsList(indicators, details) {
   console.log("=== POPULATING PHISHING INDICATORS LIST ===");
   console.log("Indicators to display:", indicators);
+  console.log("Details type:", details.type);
 
   const container = document.getElementById("techPhishingIndicators");
 
@@ -904,41 +970,98 @@ function populatePhishingIndicatorsList(indicators, details) {
         (t) => t.description && !t.description.includes("legitimacy score")
       );
       if (nonSummaryThreats.length > 0) {
-        indicatorText = nonSummaryThreats
-          .map(
-            (threat) =>
-              `• ${threat.id || threat.type || "Indicator"}: ${
-                threat.description
-              }`
-          )
-          .join("<br>");
+        const fragment = document.createDocumentFragment();
+        nonSummaryThreats.forEach((threat, index) => {
+          const line = `• ${threat.id || threat.type || "Indicator"}: ${
+            threat.description
+          }`;
+          fragment.appendChild(document.createTextNode(line));
+          if (index < nonSummaryThreats.length - 1) {
+            fragment.appendChild(document.createElement("br"));
+          }
+        });
+        container.replaceChildren(fragment);
+        return;
       }
     }
 
-    container.innerHTML = indicatorText;
+    container.textContent = indicatorText;
     return;
   }
 
-  // Create formatted list of indicators
-  const indicatorHTML = indicators
-    .map((indicator) => {
-      const id = indicator.id || indicator.type || "Unknown";
+  // Handle domain squatting techniques differently
+  if (details.type === "domain_squatting") {
+    console.log("Displaying domain squatting techniques");
+    const fragment = document.createDocumentFragment();
+    indicators.forEach((technique) => {
+      const techniqueName =
+        technique.technique || technique.id || "Unknown Technique";
       const description =
-        indicator.description || indicator.reason || "Detected";
-      const severity = indicator.severity
-        ? ` <span class="tech-badge ${
-            indicator.severity
-          }" style="margin-left: 8px;">${indicator.severity.toUpperCase()}</span>`
-        : "";
-
-      return `<div style="margin-bottom: 8px; padding: 6px; background: #f9fafb; border-radius: 4px; border-left: 3px solid #f77f00;">
-      <strong>${id}</strong>${severity}<br>
-      <span style="color: #6b7280; font-size: 11px;">${description}</span>
-    </div>`;
-    })
-    .join("");
-
-  container.innerHTML = indicatorHTML;
+        technique.description || "Domain similarity detected";
+
+      const item = document.createElement("div");
+      item.style.marginBottom = "8px";
+      item.style.padding = "6px";
+      item.style.background = "#fef3c7";
+      item.style.borderRadius = "4px";
+      item.style.borderLeft = "3px solid #f59e0b";
+
+      const title = document.createElement("strong");
+      title.textContent = techniqueName;
+
+      const descriptionSpan = document.createElement("span");
+      descriptionSpan.style.color = "#6b7280";
+      descriptionSpan.style.fontSize = "11px";
+      descriptionSpan.textContent = description;
+
+      item.appendChild(title);
+      item.appendChild(document.createElement("br"));
+      item.appendChild(descriptionSpan);
+      fragment.appendChild(item);
+    });
+
+    container.replaceChildren(fragment);
+    console.log("Populated domain squatting techniques with", indicators.length, "techniques");
+    return;
+  }
+
+  // Create formatted list of indicators for phishing
+  const fragment = document.createDocumentFragment();
+  indicators.forEach((indicator) => {
+    const id = indicator.id || indicator.type || "Unknown";
+    const description = indicator.description || indicator.reason || "Detected";
+
+    const item = document.createElement("div");
+    item.style.marginBottom = "8px";
+    item.style.padding = "6px";
+    item.style.background = "#f9fafb";
+    item.style.borderRadius = "4px";
+    item.style.borderLeft = "3px solid #f77f00";
+
+    const title = document.createElement("strong");
+    title.textContent = id;
+    item.appendChild(title);
+
+    if (indicator.severity) {
+      const severityBadge = document.createElement("span");
+      severityBadge.className = `tech-badge ${indicator.severity}`;
+      severityBadge.style.marginLeft = "8px";
+      severityBadge.textContent = indicator.severity.toUpperCase();
+      item.appendChild(document.createTextNode(" "));
+      item.appendChild(severityBadge);
+    }
+
+    const descriptionSpan = document.createElement("span");
+    descriptionSpan.style.color = "#6b7280";
+    descriptionSpan.style.fontSize = "11px";
+    descriptionSpan.textContent = description;
+
+    item.appendChild(document.createElement("br"));
+    item.appendChild(descriptionSpan);
+    fragment.appendChild(item);
+  });
+
+  container.replaceChildren(fragment);
   console.log(
     "Populated phishing indicators list with",
     indicators.length,
diff --git a/scripts/content.js b/scripts/content.js
index 60a2522..0a6bf57 100644
--- a/scripts/content.js
+++ b/scripts/content.js
@@ -30,8 +30,8 @@ if (window.checkExtensionLoaded) {
   let developerConsoleLoggingEnabled = false; // Cache for developer console logging setting
   let showingBanner = false; // Flag to prevent DOM monitoring loops when showing banners
   let escalatedToBlock = false; // Flag to indicate page has been escalated to block - stop all monitoring
-  const MAX_SCANS = 5; // Prevent infinite scanning - reduced for performance
-  const SCAN_COOLDOWN = 1200; // 1200ms between scans - increased for performance
+  const MAX_SCANS = 8; // Allow more rescans for dynamically loaded content
+  const SCAN_COOLDOWN = 800; // 800ms between scans - allow faster rescans for dynamic content
   const THREAT_TRIGGERED_COOLDOWN = 500; // Shorter cooldown for threat-triggered re-scans
   const WARNING_THRESHOLD = 3; // Block if 4+ warning threats found (escalation threshold)
   const PHISHING_PROCESSING_TIMEOUT = 10000; // 10 second timeout for phishing indicator processing
@@ -583,9 +583,25 @@ if (window.checkExtensionLoaded) {
    */
   async function loadDeveloperConsoleLoggingSetting() {
     try {
+      // Request config from background to get merged enterprise + local config
       const config = await new Promise((resolve) => {
-        chrome.storage.local.get(["config"], (result) => {
-          resolve(result.config || {});
+        chrome.runtime.sendMessage({ type: "GET_CONFIG" }, (response) => {
+          if (chrome.runtime.lastError) {
+            logger.log(
+              `[M365-Protection] Error getting config from background: ${chrome.runtime.lastError.message}`
+            );
+            // Fallback to local storage if background not available
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else if (!response || !response.success) {
+            // Fallback to local storage if response invalid
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else {
+            resolve(response.config);
+          }
         });
       });
 
@@ -1326,7 +1342,12 @@ if (window.checkExtensionLoaded) {
         try {
           let found = false;
 
-          if (element.type === "source_content") {
+          if (element.type === "code_driven" && element.code_logic) {
+            found = evaluatePrimitivePortable(pageSource, element.code_logic, {
+              cache: new Map(),
+              currentUrl: window.location.href,
+            });
+          } else if (element.type === "source_content") {
             const regex = new RegExp(element.pattern, "i");
             found = regex.test(pageSource);
           } else if (element.type === "page_title") {
@@ -1701,15 +1722,6 @@ if (window.checkExtensionLoaded) {
    */
   function setupDynamicScriptMonitoring() {
     try {
-      // Override eval to detect dynamic script execution
-      const originalEval = window.eval;
-      window.eval = function (code) {
-        scanDynamicScript(code, "eval").catch((error) => {
-          logger.warn("Dynamic script scan error (eval):", error);
-        });
-        return originalEval.call(this, code);
-      };
-
       // Override Function constructor
       const originalFunction = window.Function;
       window.Function = function () {
@@ -2055,7 +2067,7 @@ if (window.checkExtensionLoaded) {
       );
       const resources = [...source.matchAll(resourceRegex)].map((m) => m[1]);
 
-      if (resources.length === 0) return false;
+      if (resources.length === 0) return true;
 
       // Check if ALL resources are from allowed domains
       return resources.every((res) =>
@@ -2174,6 +2186,345 @@ if (window.checkExtensionLoaded) {
     }
   }
 
+  function getPortableDetectionPrimitives() {
+    return {
+      substring_present: (source, params) => {
+        const lower = source.toLowerCase();
+        return (params.values || []).some((val) =>
+          lower.includes(String(val).toLowerCase())
+        );
+      },
+      all_substrings_present: (source, params) => {
+        const lower = source.toLowerCase();
+        return (params.values || []).every((val) =>
+          lower.includes(String(val).toLowerCase())
+        );
+      },
+      substring_proximity: (source, params) => {
+        const lower = source.toLowerCase();
+        const word1 = String(params.word1 || "").toLowerCase();
+        const word2 = String(params.word2 || "").toLowerCase();
+        const maxDistance = params.max_distance || 0;
+
+        const idx1 = lower.indexOf(word1);
+        if (idx1 === -1) return false;
+
+        const searchStart = Math.max(0, idx1 - maxDistance);
+        const searchEnd = Math.min(
+          lower.length,
+          idx1 + word1.length + maxDistance
+        );
+        const chunk = lower.slice(searchStart, searchEnd);
+        return chunk.includes(word2);
+      },
+      substring_count: (source, params) => {
+        const lower = source.toLowerCase();
+        const count = (params.substrings || []).filter((sub) =>
+          lower.includes(String(sub).toLowerCase())
+        ).length;
+        return count >= (params.min_count || 0) && count <= (params.max_count || Infinity);
+      },
+      has_but_not: (source, params, context) => {
+        const lower = source.toLowerCase();
+        if (params.check_url_only && context.currentUrl) {
+          const urlLower = context.currentUrl.toLowerCase();
+          const hasRequired = (params.required || []).some((req) =>
+            urlLower.includes(String(req).toLowerCase())
+          );
+          if (!hasRequired) return false;
+          const hasProhibited = (params.prohibited || []).some((pro) =>
+            urlLower.includes(String(pro).toLowerCase())
+          );
+          return !hasProhibited;
+        }
+
+        const hasRequired = (params.required || []).some((req) =>
+          lower.includes(String(req).toLowerCase())
+        );
+        if (!hasRequired) return false;
+        const hasProhibited = (params.prohibited || []).some((pro) =>
+          lower.includes(String(pro).toLowerCase())
+        );
+        return !hasProhibited;
+      },
+      pattern_count: (source, params) => {
+        let totalCount = 0;
+        for (const pattern of params.patterns || []) {
+          const regex = new RegExp(pattern, params.flags || "gi");
+          const matches = source.match(regex);
+          totalCount += matches ? matches.length : 0;
+        }
+        return (
+          totalCount >= (params.min_count || 0) &&
+          totalCount <= (params.max_count || Infinity)
+        );
+      },
+      word_density: (source, params) => {
+        const lower = source.toLowerCase();
+        let totalCount = 0;
+        for (const word of params.words || []) {
+          const regex = new RegExp(`\\b${String(word).toLowerCase()}\\b`, "g");
+          const matches = lower.match(regex);
+          totalCount += matches ? matches.length : 0;
+        }
+        const density = totalCount / Math.max(1, source.length / 1000);
+        return density >= (params.min_density || 0);
+      },
+      substring_before: (source, params) => {
+        const lower = source.toLowerCase();
+        const idx1 = lower.indexOf(String(params.first || "").toLowerCase());
+        const idx2 = lower.indexOf(String(params.second || "").toLowerCase());
+        return idx1 !== -1 && idx2 !== -1 && idx1 < idx2;
+      },
+      substring_in_range: (source, params) => {
+        const lower = source.toLowerCase();
+        const idx = lower.indexOf(String(params.substring || "").toLowerCase());
+        if (idx === -1) return false;
+        return idx >= (params.min_position || 0) && idx <= (params.max_position || Infinity);
+      },
+      all_of: (source, params, context) => {
+        return (params.operations || []).every((op) =>
+          evaluatePrimitivePortable(source, op, context)
+        );
+      },
+      any_of: (source, params, context) => {
+        return (params.operations || []).some((op) =>
+          evaluatePrimitivePortable(source, op, context)
+        );
+      },
+      resource_pattern: (source, params) => {
+        const pattern = new RegExp(params.pattern, params.flags || "i");
+        const urlRegex = /(?:src|href|action)=["']([^"']+)["']/gi;
+        const urls = [...source.matchAll(urlRegex)].map((m) => m[1]);
+        const matchCount = urls.filter((url) => pattern.test(url)).length;
+        return (
+          matchCount >= (params.min_count || 1) &&
+          matchCount <= (params.max_count || Infinity)
+        );
+      },
+      resource_from_domain: (source, params) => {
+        const resourceType = params.resource_type;
+        const allowedDomains = params.allowed_domains || [];
+        const resourceRegex = new RegExp(
+          `(?:src|href)=["']([^"']*${resourceType}[^"']*)["']`,
+          "gi"
+        );
+        const resources = [...source.matchAll(resourceRegex)].map((m) => m[1]);
+        if (resources.length === 0) return true;
+        return resources.every((res) =>
+          allowedDomains.some((domain) => res.includes(domain))
+        );
+      },
+      multi_proximity: (source, params) => {
+        const lower = source.toLowerCase();
+        for (const pair of params.pairs || []) {
+          const word1 = String(pair.words?.[0] || "").toLowerCase();
+          const word2 = String(pair.words?.[1] || "").toLowerCase();
+          const maxDist = pair.max_distance || 0;
+          let idx1 = -1;
+          while ((idx1 = lower.indexOf(word1, idx1 + 1)) !== -1) {
+            const searchStart = Math.max(0, idx1 - maxDist);
+            const searchEnd = Math.min(
+              lower.length,
+              idx1 + word1.length + maxDist
+            );
+            if (lower.slice(searchStart, searchEnd).includes(word2)) {
+              return true;
+            }
+          }
+        }
+        return false;
+      },
+      form_action_check: (source, params) => {
+        const formRegex = /<form[^>]*action=["']([^"']*)["'][^>]*>/gi;
+        const actions = [...source.matchAll(formRegex)].map((m) => m[1]);
+        if (actions.length === 0) return false;
+        const requiredDomains = params.required_domains || [];
+        const suspiciousForms = actions.filter(
+          (action) => !requiredDomains.some((domain) => action.includes(domain))
+        );
+        return suspiciousForms.length > 0;
+      },
+      obfuscation_check: (source, params) => {
+        let matchCount = 0;
+        for (const indicator of params.indicators || []) {
+          if (source.includes(indicator)) {
+            matchCount++;
+          }
+        }
+        return matchCount >= (params.min_matches || 1);
+      },
+      not_if_contains: (source, params) => {
+        const lower = source.toLowerCase();
+        const hasProhibited = (params.prohibited || []).some((pro) =>
+          lower.includes(String(pro).toLowerCase())
+        );
+        return !hasProhibited;
+      },
+    };
+  }
+
+  const portableDetectionPrimitives = getPortableDetectionPrimitives();
+
+  function evaluatePrimitivePortable(source, operation, context = {}) {
+    const primitive = portableDetectionPrimitives[operation?.type];
+    if (!primitive) {
+      return false;
+    }
+
+    try {
+      const cacheKey = `${operation.type}:${JSON.stringify(operation)}`;
+      if (context.cache && context.cache.has(cacheKey)) {
+        return context.cache.get(cacheKey);
+      }
+
+      const result = primitive(source, operation, context);
+      const finalResult = operation.invert ? !result : result;
+      if (context.cache) {
+        context.cache.set(cacheKey, finalResult);
+      }
+      return finalResult;
+    } catch {
+      return false;
+    }
+  }
+
+  function evaluateIndicatorPortable(indicator, pageSource, pageText, currentUrl) {
+    let matches = false;
+    let matchDetails = "";
+
+    if (indicator.code_driven === true && indicator.code_logic) {
+      matches = evaluatePrimitivePortable(pageSource, indicator.code_logic, {
+        cache: new Map(),
+        currentUrl,
+      });
+      if (matches) {
+        matchDetails = "primitive match";
+      }
+
+      const lowerSource = pageSource.toLowerCase();
+
+      if (!matches && indicator.code_logic.type === "substring") {
+        matches = (indicator.code_logic.substrings || []).every((sub) =>
+          pageSource.includes(sub)
+        );
+        if (matches) matchDetails = "page source (substring match)";
+      } else if (!matches && indicator.code_logic.type === "substring_not") {
+        matches =
+          (indicator.code_logic.substrings || []).every((sub) =>
+            pageSource.includes(sub)
+          ) &&
+          (indicator.code_logic.not_substrings || []).every(
+            (sub) => !pageSource.includes(sub)
+          );
+        if (matches) matchDetails = "page source (substring + not match)";
+      } else if (!matches && indicator.code_logic.type === "allowlist") {
+        const isAllowlisted = (indicator.code_logic.allowlist || []).some(
+          (phrase) => lowerSource.includes(String(phrase).toLowerCase())
+        );
+        if (!isAllowlisted && indicator.code_logic.optimized_pattern) {
+          const optPattern = new RegExp(
+            indicator.code_logic.optimized_pattern,
+            indicator.flags || "i"
+          );
+          if (optPattern.test(pageSource)) {
+            matches = true;
+            matchDetails = "page source (optimized regex)";
+          }
+        }
+      } else if (
+        !matches &&
+        indicator.code_logic.type === "substring_not_allowlist"
+      ) {
+        const substring = indicator.code_logic.substring;
+        const allowlist = indicator.code_logic.allowlist || [];
+        if (substring && pageSource.includes(substring)) {
+          const isAllowed = allowlist.some((allowed) =>
+            lowerSource.includes(String(allowed).toLowerCase())
+          );
+          if (!isAllowed) {
+            matches = true;
+            matchDetails = "page source (substring not in allowlist)";
+          }
+        }
+      } else if (
+        !matches &&
+        indicator.code_logic.type === "substring_or_regex"
+      ) {
+        const substrings = indicator.code_logic.substrings || [];
+        for (const sub of substrings) {
+          if (lowerSource.includes(String(sub).toLowerCase())) {
+            matches = true;
+            matchDetails = "page source (substring match)";
+            break;
+          }
+        }
+        if (!matches && indicator.code_logic.regex) {
+          const pattern = new RegExp(
+            indicator.code_logic.regex,
+            indicator.code_logic.flags || "i"
+          );
+          if (pattern.test(pageSource)) {
+            matches = true;
+            matchDetails = "page source (regex match)";
+          }
+        }
+      } else if (
+        !matches &&
+        indicator.code_logic.type === "substring_with_exclusions"
+      ) {
+        const excludeList = indicator.code_logic.exclude_if_contains || [];
+        const hasExclusion = excludeList.some((excl) =>
+          lowerSource.includes(String(excl).toLowerCase())
+        );
+        if (!hasExclusion) {
+          if (indicator.code_logic.match_any) {
+            matches = indicator.code_logic.match_any.some((phrase) =>
+              lowerSource.includes(String(phrase).toLowerCase())
+            );
+            if (matches) {
+              matchDetails = "page source (substring with exclusions)";
+            }
+          } else if (indicator.code_logic.match_pattern_parts) {
+            const parts = indicator.code_logic.match_pattern_parts;
+            matches = parts.every((partGroup) =>
+              partGroup.some((part) =>
+                lowerSource.includes(String(part).toLowerCase())
+              )
+            );
+            if (matches) {
+              matchDetails = "page source (pattern parts with exclusions)";
+            }
+          }
+        }
+      }
+    } else if (indicator.pattern) {
+      const pattern = new RegExp(indicator.pattern, indicator.flags || "i");
+      if (pattern.test(pageSource)) {
+        matches = true;
+        matchDetails = "page source";
+      } else if (pattern.test(pageText)) {
+        matches = true;
+        matchDetails = "page text";
+      } else if (pattern.test(currentUrl)) {
+        matches = true;
+        matchDetails = "URL";
+      }
+
+      if (!matches && indicator.additional_checks) {
+        for (const check of indicator.additional_checks) {
+          if (pageSource.includes(check) || pageText.includes(check)) {
+            matches = true;
+            matchDetails = "additional checks";
+            break;
+          }
+        }
+      }
+    }
+
+    return { matches, matchDetails };
+  }
+
   /**
    * Process phishing indicators using Web Worker for background processing
    */
@@ -2187,6 +2538,10 @@ if (window.checkExtensionLoaded) {
       try {
         // Create inline Web Worker for background regex processing
         const workerCode = `
+          ${getPortableDetectionPrimitives.toString()}
+          ${evaluatePrimitivePortable.toString()}
+          ${evaluateIndicatorPortable.toString()}
+
           self.onmessage = function(e) {
             const { indicators, pageSource, pageText, currentUrl } = e.data;
             const threats = [];
@@ -2207,37 +2562,14 @@ if (window.checkExtensionLoaded) {
                 }
 
                 try {
-                  let matches = false;
-                  let matchDetails = "";
-
-                  const pattern = new RegExp(indicator.pattern, indicator.flags || "i");
-
-                  // Test against page source
-                  if (pattern.test(pageSource)) {
-                    matches = true;
-                    matchDetails = "page source";
-                  }
-                  // Test against visible text
-                  else if (pattern.test(pageText)) {
-                    matches = true;
-                    matchDetails = "page text";
-                  }
-                  // Test against URL
-                  else if (pattern.test(currentUrl)) {
-                    matches = true;
-                    matchDetails = "URL";
-                  }
-
-                  // Handle additional_checks
-                  if (!matches && indicator.additional_checks) {
-                    for (const check of indicator.additional_checks) {
-                      if (pageSource.includes(check) || pageText.includes(check)) {
-                        matches = true;
-                        matchDetails = "additional checks";
-                        break;
-                      }
-                    }
-                  }
+                  const evaluation = evaluateIndicatorPortable(
+                    indicator,
+                    pageSource,
+                    pageText,
+                    currentUrl
+                  );
+                  const matches = evaluation.matches;
+                  const matchDetails = evaluation.matchDetails;
 
                   if (matches) {
                     const threat = {
@@ -2392,7 +2724,7 @@ if (window.checkExtensionLoaded) {
         logger.log(`   ${i + 1}. ${ind.id}: ${patternPreview} (${ind.severity})`);
       });
 
-      // If forceMainThreadPhishingProcessing is enabled, skip Web Worker and use main thread directly
+      // If forceMainThreadPhishingProcessing is enabled, skip Web Worker and use main thread directly.
       if (forceMainThreadPhishingProcessing) {
         logger.log(
           "⏱️ DEBUG: Forcing main thread phishing processing (Web Worker disabled by UI toggle)"
@@ -2532,181 +2864,14 @@ if (window.checkExtensionLoaded) {
                 let matches = false;
                 let matchDetails = "";
 
-                // Modular code-driven logic if flagged in rules file
-                if (indicator.code_driven === true && indicator.code_logic) {
-                  if (DetectionPrimitives[indicator.code_logic.type]) {
-                    try {
-                      matches = evaluatePrimitive(
-                        pageSource,
-                        indicator.code_logic,
-                        { cache: new Map(), currentUrl: window.location.href }
-                      );
-                      if (matches) matchDetails = "primitive match";
-                    } catch (primitiveError) {
-                      logger.warn(
-                        `Primitive evaluation failed for ${indicator.id}, falling back:`,
-                        primitiveError.message
-                      );
-                      // Fall through to legacy code-driven logic below
-                    }
-                  }
-                  if (indicator.code_logic.type === "substring") {
-                    // All substrings must be present
-                    matches = (indicator.code_logic.substrings || []).every(
-                      (sub) => pageSource.includes(sub)
-                    );
-                    if (matches) matchDetails = "page source (substring match)";
-                  } else if (indicator.code_logic.type === "substring_not") {
-                    // All substrings must be present, and all not_substrings must be absent
-                    matches =
-                      (indicator.code_logic.substrings || []).every((sub) =>
-                        pageSource.includes(sub)
-                      ) &&
-                      (indicator.code_logic.not_substrings || []).every(
-                        (sub) => !pageSource.includes(sub)
-                      );
-                    if (matches)
-                      matchDetails = "page source (substring + not match)";
-                  } else if (indicator.code_logic.type === "allowlist") {
-                    // If any allowlist phrase is present, skip
-                    const lowerSource = pageSource.toLowerCase();
-                    const isAllowlisted = (
-                      indicator.code_logic.allowlist || []
-                    ).some((phrase) => lowerSource.includes(phrase));
-                    if (!isAllowlisted) {
-                      // Use optimized regex from rules file
-                      if (indicator.code_logic.optimized_pattern) {
-                        const optPattern = new RegExp(
-                          indicator.code_logic.optimized_pattern,
-                          indicator.flags || "i"
-                        );
-                        if (optPattern.test(pageSource)) {
-                          matches = true;
-                          matchDetails = "page source (optimized regex)";
-                        }
-                      }
-                    }
-                  } else if (
-                    indicator.code_logic.type === "substring_not_allowlist"
-                  ) {
-                    // Check if substring is present, then verify it's not from an allowed source
-                    const substring = indicator.code_logic.substring;
-                    const allowlist = indicator.code_logic.allowlist || [];
-
-                    if (substring && pageSource.includes(substring)) {
-                      // Substring found, now check if any allowlisted domain is also present
-                      const lowerSource = pageSource.toLowerCase();
-                      const isAllowed = allowlist.some((allowed) =>
-                        lowerSource.includes(allowed.toLowerCase())
-                      );
-
-                      if (!isAllowed) {
-                        matches = true;
-                        matchDetails =
-                          "page source (substring not in allowlist)";
-                      }
-                    }
-                  } else if (
-                    indicator.code_logic.type === "substring_or_regex"
-                  ) {
-                    // Try fast substring search first, fall back to regex
-                    const substrings = indicator.code_logic.substrings || [];
-                    const lowerSource = pageSource.toLowerCase();
-
-                    // Fast path: check if any substring is present
-                    for (const sub of substrings) {
-                      if (lowerSource.includes(sub.toLowerCase())) {
-                        matches = true;
-                        matchDetails = "page source (substring match)";
-                        break;
-                      }
-                    }
-
-                    // Fallback: use regex if no substring matched
-                    if (!matches && indicator.code_logic.regex) {
-                      const pattern = new RegExp(
-                        indicator.code_logic.regex,
-                        indicator.code_logic.flags || "i"
-                      );
-                      if (pattern.test(pageSource)) {
-                        matches = true;
-                        matchDetails = "page source (regex match)";
-                      }
-                    }
-                  } else if (
-                    indicator.code_logic.type === "substring_with_exclusions"
-                  ) {
-                    // Check for matching patterns but exclude if exclusion phrases are present
-                    const lowerSource = pageSource.toLowerCase();
-
-                    // First check exclusions - if any found, skip this rule entirely
-                    const excludeList =
-                      indicator.code_logic.exclude_if_contains || [];
-                    const hasExclusion = excludeList.some((excl) =>
-                      lowerSource.includes(excl.toLowerCase())
-                    );
-
-                    if (!hasExclusion) {
-                      // No exclusions found, now check for matches
-                      if (indicator.code_logic.match_any) {
-                        // Simple match - check if any phrase is present
-                        matches = indicator.code_logic.match_any.some(
-                          (phrase) => lowerSource.includes(phrase.toLowerCase())
-                        );
-                        if (matches)
-                          matchDetails =
-                            "page source (substring with exclusions)";
-                      } else if (indicator.code_logic.match_pattern_parts) {
-                        // Complex match - all pattern parts must be present
-                        const parts = indicator.code_logic.match_pattern_parts;
-                        matches = parts.every((partGroup) =>
-                          partGroup.some((part) =>
-                            lowerSource.includes(part.toLowerCase())
-                          )
-                        );
-                        if (matches)
-                          matchDetails =
-                            "page source (pattern parts with exclusions)";
-                      }
-                    }
-                  }
-                } else {
-                  // Default: regex-driven logic
-                  const pattern = new RegExp(
-                    indicator.pattern,
-                    indicator.flags || "i"
-                  );
-
-                  // Test against page source
-                  if (pattern.test(pageSource)) {
-                    matches = true;
-                    matchDetails = "page source";
-                  }
-                  // Test against visible text
-                  else if (pattern.test(pageText)) {
-                    matches = true;
-                    matchDetails = "page text";
-                  }
-                  // Test against URL
-                  else if (pattern.test(currentUrl)) {
-                    matches = true;
-                    matchDetails = "URL";
-                  }
-
-                  // Handle additional_checks
-                  if (!matches && indicator.additional_checks) {
-                    for (const check of indicator.additional_checks) {
-                      if (
-                        pageSource.includes(check) ||
-                        pageText.includes(check)
-                      ) {
-                        matches = true;
-                        matchDetails = "additional checks";
-                        break;
-                      }
-                    }
-                  }
-                }
+                const evaluation = evaluateIndicatorPortable(
+                  indicator,
+                  pageSource,
+                  pageText,
+                  currentUrl
+                );
+                matches = evaluation.matches;
+                matchDetails = evaluation.matchDetails;
 
                 // Handle context_required field for conditional detection
                 if (matches && indicator.context_required) {
@@ -3944,7 +4109,136 @@ if (window.checkExtensionLoaded) {
         }`
       );
 
-      // Step 4: Pre-check domain for obvious non-threats only
+      // Step 4: Check for domain squatting (typosquatting, homoglyphs, etc.)
+      // This runs BEFORE phishing detection to catch domain-based threats early
+      try {
+        const domainSquattingResult = await chrome.runtime.sendMessage({
+          type: "check_domain_squatting",
+          domain: window.location.hostname
+        });
+        
+        if (domainSquattingResult?.success && domainSquattingResult.result?.detected) {
+          const squattingData = domainSquattingResult.result;
+          logger.warn(`⚠️ DOMAIN SQUATTING DETECTED:`);
+          logger.warn(`  Test Domain: ${squattingData.testDomain}`);
+          logger.warn(`  Protected Domain: ${squattingData.protectedDomain}`);
+          logger.warn(`  Techniques: ${squattingData.techniques.map(t => t.technique).join(', ')}`);
+          logger.warn(`  Severity: ${squattingData.severity}`);
+          logger.warn(`  Confidence: ${(squattingData.confidence * 100).toFixed(1)}%`);
+          logger.warn(`  Action: ${squattingData.action || 'warn'}`);
+          
+          // Check if notifications should be shown
+          const showNotifications = config.showNotifications !== false;
+          
+          // Determine if we should block the page
+          // Requires: 1) enablePageBlocking is ON, 2) domain_squatting action is "block"
+          logger.debug(`  enablePageBlocking: ${config.enablePageBlocking}`);
+          logger.debug(`  squattingData.action: ${squattingData.action}`);
+          const shouldBlock = squattingData.action === 'block' && 
+                             config.enablePageBlocking !== false;
+          logger.debug(`  shouldBlock: ${shouldBlock}`);
+          
+          // Log domain squatting detection
+          logProtectionEvent({
+            type: "threat_detected",
+            action: shouldBlock ? "blocked" : "warned",
+            url: location.href,
+            origin: currentOrigin,
+            reason: `Domain squatting detected: ${squattingData.techniques.map(t => t.description).join('; ')}`,
+            severity: squattingData.severity,
+            redirectTo: null,
+            clientId: null,
+            ruleType: "domain_squatting",
+            squattingDetails: squattingData
+          });
+          
+          // Send CIPP report for domain squatting detection
+          sendCippReport({
+            type: "domain_squatting_detected",
+            url: defangUrl(location.href),
+            origin: currentOrigin,
+            testDomain: squattingData.testDomain,
+            protectedDomain: squattingData.protectedDomain,
+            techniques: squattingData.techniques.map(t => ({
+              ...t
+            })),
+            severity: squattingData.severity,
+            confidence: squattingData.confidence,
+            action: shouldBlock ? "blocked" : "warned",
+            reason: `Domain squatting detected: ${squattingData.techniques.map(t => t.description).join('; ')}`
+          });
+          
+          // Send domain_squatting_detected webhook
+          chrome.runtime
+            .sendMessage({
+              type: "send_webhook",
+              webhookType: "domain_squatting_detected",
+              data: {
+                url: defangUrl(location.href),
+                testDomain: squattingData.testDomain,
+                protectedDomain: squattingData.protectedDomain,
+                techniques: squattingData.techniques.map(t => ({
+                  technique: t.technique,
+                  description: t.description
+                })),
+                severity: squattingData.severity,
+                confidence: squattingData.confidence,
+                action: shouldBlock ? "blocked" : "warned",
+                reason: `Domain squatting detected: ${squattingData.techniques.map(t => t.description).join('; ')}`
+              },
+            })
+            .catch((err) => {
+              logger.debug("Failed to send domain squatting webhook:", err);
+            });
+          
+          if (shouldBlock) {
+            // Block the page - redirect to blocked page with domain squatting context
+            const techniquesDesc = squattingData.techniques.map(t => 
+              `${t.technique}: ${t.description}`
+            ).join('; ');
+            
+            await showBlockingOverlay(
+              `Domain Squatting: This site closely resembles "${squattingData.protectedDomain}" but is not the legitimate site`,
+              {
+                type: "domain_squatting",
+                severity: squattingData.severity,
+                testDomain: squattingData.testDomain,
+                protectedDomain: squattingData.protectedDomain,
+                techniques: squattingData.techniques,
+                confidence: squattingData.confidence,
+                reason: `Domain squatting detected: ${techniquesDesc}`,
+                detectionMethod: "domain-squatting",
+                detectionTime: Date.now()
+              }
+            );
+            return; // Stop processing, page is blocked
+          } else if (showNotifications) {
+            // Show warning banner for domain squatting (only if notifications enabled)
+            const techniquesDesc = squattingData.techniques.map(t => 
+              `${t.technique}: ${t.description}`
+            ).join('\n');
+            
+            showWarningBanner(
+              `⚠️ POTENTIAL DOMAIN SQUATTING: This domain closely resembles "${squattingData.protectedDomain}"`,
+              {
+                type: "domain_squatting",
+                severity: squattingData.severity,
+                reason: `Domain squatting techniques detected:\n${techniquesDesc}`,
+                protectedDomain: squattingData.protectedDomain,
+                confidence: squattingData.confidence,
+                techniques: squattingData.techniques
+              }
+            );
+          }
+          
+          // If we showed a warning but not blocking, continue with phishing detection
+          // If we blocked, we already returned above
+        }
+      } catch (squattingError) {
+        logger.debug("Domain squatting check failed or disabled:", squattingError.message);
+      }
+
+      // Step 5: Pre-check domain for obvious non-threats only
       // NOTE: We removed the restrictive domain check that was blocking training platforms
       // like KnowBe4. Phishing simulations use legitimate domains but copy Microsoft UI.
       // Let content-based detection handle all cases.
@@ -3956,7 +4250,7 @@ if (window.checkExtensionLoaded) {
         `Analyzing domain "${currentDomain}" - proceeding with content-based detection`
       );
 
-      // Step 5: Check if page is an MS logon page (using rule file requirements)
+      // Step 6: Check if page is an MS logon page (using rule file requirements)
       const msDetection = detectMicrosoftElements();
       if (!msDetection.isLogonPage) {
         // Check if page has ANY Microsoft-related elements before running expensive phishing indicators
@@ -5009,11 +5303,16 @@ if (window.checkExtensionLoaded) {
 
         const redirectHostname = extractRedirectHostname(location.href);
         const clientInfo = await extractClientInfo(location.href);
+        const threatAction =
+          severity === "high" && protectionEnabled ? "blocked" : "warned";
+        const threatEventType =
+          threatAction === "blocked" || threatAction === "warned"
+            ? "threat_detected"
+            : "threat_detected_no_action";
 
         logProtectionEvent({
-          type: protectionEnabled
-            ? "threat_detected"
-            : "threat_detected_no_action",
+          type: threatEventType,
+          action: threatAction,
           url: location.href,
           threatLevel: severity,
           reason: reason,
@@ -5342,6 +5641,8 @@ if (window.checkExtensionLoaded) {
       });
 
       // Fallback: Check periodically for content that might have loaded without triggering observer
+      let fallbackCheckCount = 0;
+      const MAX_FALLBACK_CHECKS = 5; // Allow up to 5 fallback checks
       const checkInterval = setInterval(() => {
         // Stop if page has been escalated to block
         if (escalatedToBlock) {
@@ -5360,17 +5661,27 @@ if (window.checkExtensionLoaded) {
           return;
         }
 
+        fallbackCheckCount++;
         const currentElementCount = document.querySelectorAll("*").length;
         const hasSignificantContent = document.body?.textContent?.length > 1000;
 
         if (hasSignificantContent && currentElementCount > 50) {
           logger.log(
-            "⏰ Fallback timer detected significant content - re-running analysis"
+            `⏰ Fallback timer detected significant content - re-running analysis (check ${fallbackCheckCount}/${MAX_FALLBACK_CHECKS})`
           );
-          clearInterval(checkInterval);
           runProtection(true);
+          
+          // Stop after MAX_FALLBACK_CHECKS successful rescans
+          if (fallbackCheckCount >= MAX_FALLBACK_CHECKS) {
+            logger.log("⏰ Maximum fallback checks reached - stopping");
+            clearInterval(checkInterval);
+          }
+        } else if (fallbackCheckCount >= MAX_FALLBACK_CHECKS) {
+          // Stop after MAX_FALLBACK_CHECKS attempts even if no significant content
+          logger.debug("⏰ Maximum fallback check attempts reached - stopping");
+          clearInterval(checkInterval);
         }
-      }, 2000);
+      }, 1500); // Check every 1.5 seconds
 
       // Stop monitoring after 30 seconds to prevent resource drain
       setTimeout(() => {
@@ -5482,9 +5793,30 @@ if (window.checkExtensionLoaded) {
       );
 
       // Immediately redirect to blocking page - no user override option
-      location.replace(blockingPageUrl);
+      try {
+        location.replace(blockingPageUrl);
+        logger.log("Redirected to Chrome blocking page");
+      } catch (redirectError) {
+        logger.warn(
+          "Direct blocked page redirect failed, attempting background tab redirect:",
+          redirectError.message
+        );
 
-      logger.log("Redirected to Chrome blocking page");
+        const redirectResponse = await chrome.runtime.sendMessage({
+          type: "REDIRECT_TO_BLOCKED_PAGE",
+          url: blockingPageUrl,
+        });
+
+        if (redirectResponse?.success) {
+          logger.log("Redirected to blocking page via background script");
+          return;
+        }
+
+        throw new Error(
+          redirectResponse?.error ||
+            "Background redirect failed with unknown error"
+        );
+      }
     } catch (error) {
       logger.error("Failed to redirect to blocking page:", error.message);
 
@@ -5509,17 +5841,58 @@ if (window.checkExtensionLoaded) {
         // CRITICAL: Register overlay before adding to DOM
         registerInjectedElement(overlay);
 
-        overlay.innerHTML = `
-          <div style="max-width: 600px; padding: 40px; text-align: center; font-family: system-ui, -apple-system, sans-serif;">
-            <div style="font-size: 64px; color: #d32f2f; margin-bottom: 24px;">🛡️</div>
-            <h1 style="color: #d32f2f; margin: 0 0 16px 0;">Phishing Site Blocked</h1>
-            <p><strong>Microsoft 365 login page detected on suspicious domain.</strong></p>
-            <p>This site may be attempting to steal your credentials and has been blocked for your protection.</p>
-            <div style="color: #777; font-size: 14px; margin-top: 24px;">Reason: ${reason}</div>
-            <div style="color: #777; font-size: 14px;">Blocked by: Check</div>
-            <div style="color: #777; font-size: 14px;">No override available - contact your administrator if this is incorrect</div>
-          </div>
-        `;
+        const content = document.createElement("div");
+        content.style.maxWidth = "600px";
+        content.style.padding = "40px";
+        content.style.textAlign = "center";
+        content.style.fontFamily = "system-ui, -apple-system, sans-serif";
+
+        const shield = document.createElement("div");
+        shield.style.fontSize = "64px";
+        shield.style.color = "#d32f2f";
+        shield.style.marginBottom = "24px";
+        shield.textContent = "🛡️";
+
+        const title = document.createElement("h1");
+        title.style.color = "#d32f2f";
+        title.style.margin = "0 0 16px 0";
+        title.textContent = "Phishing Site Blocked";
+
+        const paragraphStrong = document.createElement("p");
+        const strong = document.createElement("strong");
+        strong.textContent =
+          "Microsoft 365 login page detected on suspicious domain.";
+        paragraphStrong.appendChild(strong);
+
+        const paragraphDetails = document.createElement("p");
+        paragraphDetails.textContent =
+          "This site may be attempting to steal your credentials and has been blocked for your protection.";
+
+        const reasonLine = document.createElement("div");
+        reasonLine.style.color = "#777";
+        reasonLine.style.fontSize = "14px";
+        reasonLine.style.marginTop = "24px";
+        reasonLine.textContent = `Reason: ${reason}`;
+
+        const blockedByLine = document.createElement("div");
+        blockedByLine.style.color = "#777";
+        blockedByLine.style.fontSize = "14px";
+        blockedByLine.textContent = "Blocked by: Check";
+
+        const noOverrideLine = document.createElement("div");
+        noOverrideLine.style.color = "#777";
+        noOverrideLine.style.fontSize = "14px";
+        noOverrideLine.textContent =
+          "No override available - contact your administrator if this is incorrect";
+
+        content.appendChild(shield);
+        content.appendChild(title);
+        content.appendChild(paragraphStrong);
+        content.appendChild(paragraphDetails);
+        content.appendChild(reasonLine);
+        content.appendChild(blockedByLine);
+        content.appendChild(noOverrideLine);
+        overlay.appendChild(content);
 
         document.body.appendChild(overlay);
 
@@ -5580,12 +5953,27 @@ if (window.checkExtensionLoaded) {
       // Set flag to prevent DOM monitoring loops
       showingBanner = true;
 
-      // Fetch branding configuration (uniform pattern: storage only, like applyBrandingColors)
+      // Fetch branding configuration from background to get merged config
       const fetchBranding = () =>
         new Promise((resolve) => {
           try {
-            chrome.storage.local.get(["brandingConfig"], (result) => {
-              resolve(result?.brandingConfig || {});
+            chrome.runtime.sendMessage({ type: "GET_BRANDING_CONFIG" }, (response) => {
+              if (chrome.runtime.lastError) {
+                logger.log(
+                  `[M365-Protection] Error getting branding from background: ${chrome.runtime.lastError.message}`
+                );
+                // Fallback to local storage if background not available
+                chrome.storage.local.get(["brandingConfig"], (result) => {
+                  resolve(result?.brandingConfig || {});
+                });
+              } else if (!response || !response.success) {
+                // Fallback to local storage if response invalid
+                chrome.storage.local.get(["brandingConfig"], (result) => {
+                  resolve(result?.brandingConfig || {});
+                });
+              } else {
+                resolve(response.branding || {});
+              }
             });
           } catch (_) {
             resolve({});
@@ -5789,6 +6177,20 @@ if (window.checkExtensionLoaded) {
         bannerIcon = "🔍";
         bannerColor = "linear-gradient(135deg, #2196f3, #1976d2)"; // Blue for scanning
       }
+      // Check for domain squatting detection - tailored messaging
+      else if (
+        analysisData?.type === "domain_squatting" ||
+        reason.toLowerCase().includes("domain squatting") ||
+        reason.toLowerCase().includes("typosquat")
+      ) {
+        bannerTitle = "⚠️ Suspicious Domain Detected";
+        bannerIcon = "🔗";
+        bannerColor = "linear-gradient(135deg, #ff5722, #d84315)"; // Same orange-red as high risk warnings
+        // Override reason text for domain squatting to be more user-friendly
+        if (analysisData?.protectedDomain) {
+          reason = `This website's domain looks similar to "${analysisData.protectedDomain}" but is NOT the legitimate site. Be careful entering any credentials.`;
+        }
+      }
       // Check for rogue app detection
       else if (
         analysisData?.type === "rogue_app_on_legitimate_domain" ||
@@ -5808,28 +6210,98 @@ if (window.checkExtensionLoaded) {
         bannerColor = "linear-gradient(135deg, #ff5722, #d84315)"; // Orange-red for high risk
       }
 
-      // Layout: left branding slot, absolutely centered message block, dismiss button on right.
-      const bannerContent = `
-        <div style="position:relative;display:flex;align-items:center;gap:16px;min-height:56px;">
-          <div id="check-banner-left" style="display:flex;align-items:center;gap:12px;z-index:2;"></div>
-          <div style="position:absolute;left:50%;top:50%;transform:translate(-50%,-50%);text-align:center;max-width:60%;z-index:1;pointer-events:none;">
-            <span style="display:block;font-size:24px;margin-bottom:4px;">${bannerIcon}</span>
-            <strong style="display:block;">${bannerTitle}</strong>
-            <small style="opacity:0.95;display:block;margin-top:2px;">${reason}${detailsText}</small>
-          </div>
-          <button onclick="this.closest('#ms365-warning-banner').remove(); document.body.style.marginTop = '0'; window.showingBanner = false;" title="Dismiss" style="
-            margin-left:auto;position:relative;background:rgba(255,255,255,0.2);border:1px solid rgba(255,255,255,0.3);
-            color:#fff;padding:0;border-radius:4px;cursor:pointer;
-            width:24px;height:24px;min-width:24px;min-height:24px;display:flex;align-items:center;justify-content:center;
-            font-size:14px;font-weight:bold;line-height:1;box-sizing:border-box;font-family:monospace;z-index:2;">×</button>
-        </div>`;
+      const renderBannerContent = (bannerElement) => {
+        if (!bannerElement) return;
+
+        const root = document.createElement("div");
+        root.style.position = "relative";
+        root.style.display = "flex";
+        root.style.alignItems = "center";
+        root.style.gap = "16px";
+        root.style.minHeight = "56px";
+        root.style.paddingRight = "40px";
+
+        const left = document.createElement("div");
+        left.id = "check-banner-left";
+        left.style.display = "flex";
+        left.style.alignItems = "center";
+        left.style.gap = "12px";
+        left.style.zIndex = "2";
+
+        const center = document.createElement("div");
+        center.style.position = "absolute";
+        center.style.left = "50%";
+        center.style.top = "50%";
+        center.style.transform = "translate(-50%,-50%)";
+        center.style.textAlign = "center";
+        center.style.maxWidth = "60%";
+        center.style.zIndex = "1";
+        center.style.pointerEvents = "none";
+
+        const icon = document.createElement("span");
+        icon.style.display = "block";
+        icon.style.fontSize = "24px";
+        icon.style.marginBottom = "4px";
+        icon.textContent = bannerIcon;
+
+        const title = document.createElement("strong");
+        title.style.display = "block";
+        title.textContent = bannerTitle;
+
+        const subtitle = document.createElement("small");
+        subtitle.style.opacity = "0.95";
+        subtitle.style.display = "block";
+        subtitle.style.marginTop = "2px";
+        subtitle.textContent = `${reason}${detailsText}`;
+
+        center.appendChild(icon);
+        center.appendChild(title);
+        center.appendChild(subtitle);
+
+        const dismissButton = document.createElement("button");
+        dismissButton.title = "Dismiss";
+        dismissButton.style.position = "absolute";
+        dismissButton.style.right = "16px";
+        dismissButton.style.top = "50%";
+        dismissButton.style.transform = "translateY(-50%)";
+        dismissButton.style.background = "rgba(255,255,255,0.2)";
+        dismissButton.style.border = "1px solid rgba(255,255,255,0.3)";
+        dismissButton.style.color = "#fff";
+        dismissButton.style.padding = "0";
+        dismissButton.style.borderRadius = "4px";
+        dismissButton.style.cursor = "pointer";
+        dismissButton.style.width = "24px";
+        dismissButton.style.height = "24px";
+        dismissButton.style.minWidth = "24px";
+        dismissButton.style.minHeight = "24px";
+        dismissButton.style.display = "flex";
+        dismissButton.style.alignItems = "center";
+        dismissButton.style.justifyContent = "center";
+        dismissButton.style.fontSize = "14px";
+        dismissButton.style.fontWeight = "bold";
+        dismissButton.style.lineHeight = "1";
+        dismissButton.style.boxSizing = "border-box";
+        dismissButton.style.fontFamily = "monospace";
+        dismissButton.style.zIndex = "3";
+        dismissButton.textContent = "×";
+        dismissButton.addEventListener("click", () => {
+          bannerElement.remove();
+          document.body.style.marginTop = "0";
+          showingBanner = false;
+        });
+
+        root.appendChild(left);
+        root.appendChild(center);
+        root.appendChild(dismissButton);
+        bannerElement.replaceChildren(root);
+      };
 
       // Check if banner already exists
       let banner = document.getElementById("ms365-warning-banner");
 
       if (banner) {
         // Update existing banner content and color
-        banner.innerHTML = bannerContent;
+        renderBannerContent(banner);
         banner.style.background = bannerColor;
         fetchBranding().then((branding) => applyBranding(banner, branding));
 
@@ -5861,7 +6333,7 @@ if (window.checkExtensionLoaded) {
       // CRITICAL: Register the banner BEFORE adding to DOM
       registerInjectedElement(banner);
 
-      banner.innerHTML = bannerContent;
+      renderBannerContent(banner);
       document.body.insertBefore(banner, document.body.firstChild);
 
       // Register all child elements created via innerHTML
@@ -5902,10 +6374,25 @@ if (window.checkExtensionLoaded) {
         validBadgeTimeoutId = null;
       }
 
-      // Load timeout configuration
+      // Load timeout configuration from background to get merged config
       const config = await new Promise((resolve) => {
-        chrome.storage.local.get(["config"], (result) => {
-          resolve(result.config || {});
+        chrome.runtime.sendMessage({ type: "GET_CONFIG" }, (response) => {
+          if (chrome.runtime.lastError) {
+            logger.log(
+              `[M365-Protection] Error getting config from background: ${chrome.runtime.lastError.message}`
+            );
+            // Fallback to local storage if background not available
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else if (!response || !response.success) {
+            // Fallback to local storage if response invalid
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else {
+            resolve(response.config);
+          }
         });
       });
 
@@ -6272,24 +6759,45 @@ if (window.checkExtensionLoaded) {
       const isCriticalThreat = severity === "critical" || severity === "high";
       const isRogueApp = reportData.type === "critical_rogue_app_detected";
       const isPhishingBlocked = reportData.type === "phishing_blocked";
+      const isBlockedDomainSquatting =
+        reportData.type === "domain_squatting_detected" &&
+        reportData.action === "blocked";
 
       // Allow critical/high threats and rogue apps, skip informational reports
-      if (!isCriticalThreat && !isRogueApp && !isPhishingBlocked) {
+      if (
+        !isCriticalThreat &&
+        !isRogueApp &&
+        !isPhishingBlocked &&
+        !isBlockedDomainSquatting
+      ) {
         logger.debug(
-          `CIPP reporting skipped for ${reportData.type} - only high/critical threats are reported`
+          `CIPP reporting skipped for ${reportData.type} - only high/critical threats or blocked domain squatting events are reported`
         );
         return;
       }
 
-      // Get CIPP configuration from storage
-      const result = await new Promise((resolve) => {
-        chrome.storage.local.get(["config"], (result) => {
-          resolve(result.config || {});
+      // Get CIPP configuration from background to get merged config
+      const config = await new Promise((resolve) => {
+        chrome.runtime.sendMessage({ type: "GET_CONFIG" }, (response) => {
+          if (chrome.runtime.lastError) {
+            logger.log(
+              `[M365-Protection] Error getting config from background: ${chrome.runtime.lastError.message}`
+            );
+            // Fallback to local storage if background not available
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else if (!response || !response.success) {
+            // Fallback to local storage if response invalid
+            chrome.storage.local.get(["config"], (result) => {
+              resolve(result.config || {});
+            });
+          } else {
+            resolve(response.config);
+          }
         });
       });
 
-      const config = result;
-
       // Check if CIPP reporting is enabled and URL is configured
       if (!config.enableCippReporting || !config.cippServerUrl) {
         logger.debug("CIPP reporting disabled or no server URL configured");
@@ -6348,10 +6856,25 @@ if (window.checkExtensionLoaded) {
    */
   async function applyBrandingColors() {
     try {
-      // Get branding configuration from storage
+      // Get branding configuration from background to get merged config
       const result = await new Promise((resolve) => {
-        chrome.storage.local.get(["brandingConfig"], (result) => {
-          resolve(result.brandingConfig || {});
+        chrome.runtime.sendMessage({ type: "GET_BRANDING_CONFIG" }, (response) => {
+          if (chrome.runtime.lastError) {
+            logger.log(
+              `[M365-Protection] Error getting branding from background: ${chrome.runtime.lastError.message}`
+            );
+            // Fallback to local storage if background not available
+            chrome.storage.local.get(["brandingConfig"], (result) => {
+              resolve(result?.brandingConfig || {});
+            });
+          } else if (!response || !response.success) {
+            // Fallback to local storage if response invalid
+            chrome.storage.local.get(["brandingConfig"], (result) => {
+              resolve(result?.brandingConfig || {});
+            });
+          } else {
+            resolve(response.branding || {});
+          }
         });
       });
 
@@ -6382,12 +6905,101 @@ if (window.checkExtensionLoaded) {
     }
   }
 
+  /**
+   * Track network activity for better timing detection
+   */
+  let pendingRequests = 0;
+  let networkIdleTimer = null;
+  let lastNetworkActivity = Date.now();
+
+  /**
+   * Monitor fetch/XHR to detect when network is idle
+   */
+  function setupNetworkMonitoring() {
+    // Intercept fetch
+    const originalFetch = window.fetch;
+    window.fetch = function(...args) {
+      pendingRequests++;
+      lastNetworkActivity = Date.now();
+      logger.debug(`🌐 Fetch request started (pending: ${pendingRequests})`);
+      
+      return originalFetch.apply(this, arguments).finally(() => {
+        pendingRequests--;
+        lastNetworkActivity = Date.now();
+        logger.debug(`🌐 Fetch request completed (pending: ${pendingRequests})`);
+        checkNetworkIdle();
+      });
+    };
+
+    // Intercept XMLHttpRequest
+    const originalOpen = XMLHttpRequest.prototype.open;
+    const originalSend = XMLHttpRequest.prototype.send;
+    
+    XMLHttpRequest.prototype.open = function(...args) {
+      this._check_tracked = true;
+      return originalOpen.apply(this, args);
+    };
+    
+    XMLHttpRequest.prototype.send = function(...args) {
+      if (this._check_tracked) {
+        pendingRequests++;
+        lastNetworkActivity = Date.now();
+        logger.debug(`🌐 XHR request started (pending: ${pendingRequests})`);
+        
+        this.addEventListener('loadend', () => {
+          pendingRequests--;
+          lastNetworkActivity = Date.now();
+          logger.debug(`🌐 XHR request completed (pending: ${pendingRequests})`);
+          checkNetworkIdle();
+        });
+      }
+      return originalSend.apply(this, args);
+    };
+  }
+
+  /**
+   * Check if network has been idle for a period
+   */
+  function checkNetworkIdle() {
+    if (networkIdleTimer) {
+      clearTimeout(networkIdleTimer);
+    }
+    
+    // Wait 300ms after last network activity before considering network "idle"
+    networkIdleTimer = setTimeout(() => {
+      if (pendingRequests === 0) {
+        const timeSinceActivity = Date.now() - lastNetworkActivity;
+        if (timeSinceActivity >= 300) {
+          logger.log("🌐 Network idle detected - content likely loaded");
+          // Trigger a scan if we haven't scanned recently
+          if (scanCount < MAX_SCANS && !showingBanner && !escalatedToBlock) {
+            logger.log("🔄 Triggering scan after network idle");
+            runProtection(true);
+          }
+        }
+      }
+    }, 300);
+  }
+
+  /**
+   * Check if critical elements exist (forms, inputs, etc.)
+   */
+  function hasCriticalElements() {
+    const hasForm = document.querySelector('form') !== null;
+    const hasPasswordInput = document.querySelector('input[type="password"]') !== null;
+    const hasEmailInput = document.querySelector('input[type="email"]') !== null;
+    const hasTextInput = document.querySelectorAll('input[type="text"]').length > 0;
+    
+    return hasForm || hasPasswordInput || hasEmailInput || hasTextInput;
+  }
+
   /**
    * Initialize protection when DOM is ready
    */
   function initializeProtection() {
     try {
       logger.log("Initializing Check");
+      logger.log(`Initial document.readyState: ${document.readyState}`);
 
       // Console capture is now setup only when developer mode is enabled (see loadDeveloperConsoleLoggingSetting)
       // This eliminates performance overhead for normal users
@@ -6397,15 +7009,121 @@ if (window.checkExtensionLoaded) {
 
       // Setup dynamic script monitoring early to catch any immediate script execution
       setupDynamicScriptMonitoring();
+      
+      // Setup network monitoring for better timing detection
+      setupNetworkMonitoring();
+
+      // Track when we've completed different loading stages
+      let domContentLoadedFired = false;
+      let windowLoadFired = false;
+      let initialScanDone = false;
+
+      /**
+       * Perform initial scan with smart timing
+       */
+      function performInitialScan() {
+        if (initialScanDone) {
+          logger.debug("Initial scan already completed, skipping");
+          return;
+        }
+        
+        initialScanDone = true;
+        logger.log("📊 Performing initial scan");
+        logger.log(`  - DOMContentLoaded: ${domContentLoadedFired}`);
+        logger.log(`  - window.load: ${windowLoadFired}`);
+        logger.log(`  - Pending requests: ${pendingRequests}`);
+        logger.log(`  - Critical elements: ${hasCriticalElements()}`);
+        
+        runProtection();
+      }
 
+      // Strategy 1: Wait for DOMContentLoaded if still loading
       if (document.readyState === "loading") {
+        logger.log("⏳ Document still loading, waiting for DOMContentLoaded");
+        
         document.addEventListener("DOMContentLoaded", () => {
-          setTimeout(runProtection, 100); // Small delay to ensure DOM is stable
+          domContentLoadedFired = true;
+          logger.log("✅ DOMContentLoaded fired");
+          
+          // Check if critical elements already exist
+          if (hasCriticalElements()) {
+            logger.log("🎯 Critical elements detected immediately after DOMContentLoaded");
+            // Scan quickly if we have forms/inputs
+            setTimeout(performInitialScan, 200);
+          } else {
+            // Wait a bit longer for dynamic content
+            setTimeout(performInitialScan, 600);
+          }
         });
       } else {
-        // DOM already ready
-        setTimeout(runProtection, 100);
+        // DOM already loaded
+        domContentLoadedFired = true;
+        logger.log("✅ Document already loaded (readyState: " + document.readyState + ")");
+        
+        if (hasCriticalElements()) {
+          logger.log("🎯 Critical elements already present");
+          // Scan quickly if we have forms/inputs
+          setTimeout(performInitialScan, 200);
+        } else {
+          // Wait longer for dynamic content to load
+          setTimeout(performInitialScan, 800);
+        }
+      }
+
+      // Strategy 2: Also wait for window.load event (all resources loaded)
+      if (document.readyState !== "complete") {
+        window.addEventListener("load", () => {
+          windowLoadFired = true;
+          logger.log("✅ Window load event fired (all resources loaded)");
+          
+          // Trigger another scan if initial scan was too early
+          if (initialScanDone && !hasCriticalElements() && scanCount < MAX_SCANS) {
+            logger.log("🔄 Re-scanning after window.load as critical elements may have loaded");
+            setTimeout(() => runProtection(true), 300);
+          }
+        });
+      } else {
+        windowLoadFired = true;
+        logger.log("✅ Window already fully loaded");
       }
+
+      // Strategy 3: Monitor for critical elements appearing
+      // If we scan early and find nothing, watch for forms/inputs to appear
+      const criticalElementObserver = new MutationObserver((mutations) => {
+        for (const mutation of mutations) {
+          if (mutation.type === "childList") {
+            for (const node of mutation.addedNodes) {
+              if (node.nodeType === Node.ELEMENT_NODE) {
+                const tagName = node.tagName?.toLowerCase();
+                // If a form or input appears, trigger immediate scan
+                if (tagName === "form" || tagName === "input") {
+                  logger.log("🎯 Critical element detected via observer: " + tagName);
+                  criticalElementObserver.disconnect();
+                  
+                  if (scanCount < MAX_SCANS && !showingBanner && !escalatedToBlock) {
+                    logger.log("🔄 Triggering immediate scan");
+                    runProtection(true);
+                  }
+                  return;
+                }
+              }
+            }
+          }
+        }
+      });
+
+      // Start observing for critical elements
+      criticalElementObserver.observe(document.documentElement, {
+        childList: true,
+        subtree: true,
+      });
+
+      // Stop observing after 5 seconds
+      setTimeout(() => {
+        criticalElementObserver.disconnect();
+        logger.debug("Critical element observer stopped");
+      }, 5000);
+
     } catch (error) {
       logger.error("Failed to initialize protection:", error.message);
     }
diff --git a/scripts/modules/config-manager.js b/scripts/modules/config-manager.js
index 2627a06..7a87673 100644
--- a/scripts/modules/config-manager.js
+++ b/scripts/modules/config-manager.js
@@ -111,12 +111,28 @@ export class ConfigManager {
             "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json",
           updateInterval: 24,
           enableDebugLogging: false,
+          domainSquatting: {
+            enabled: true,
+            deviationThreshold: 2,
+            algorithms: {
+              levenshtein: true,
+              homoglyph: true,
+              typosquat: true,
+              combosquat: true,
+            },
+            protectedDomains: [],
+            Action: "block",
+            logDetections: true,
+          },
           // Note: enableDeveloperConsoleLogging is not policy-managed - remains under user control
 
           // Custom branding (matches managed_schema.json structure)
           customBranding: {
             companyName: "CyberDrain",
             productName: "Check Enterprise",
+            supportUrl: "",
+            privacyPolicyUrl: "",
+            aboutUrl: "",
             primaryColor: "#F77F00",
             logoUrl:
               "https://cyberdrain.com/images/favicon_hu_20e77b0e20e363e.png",
@@ -288,6 +304,21 @@ export class ConfigManager {
       customRulesUrl: "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json",
       updateInterval: 24, // hours
 
+      // Domain squatting runtime settings
+      domainSquatting: {
+        enabled: true,
+        deviationThreshold: 2,
+        algorithms: {
+          levenshtein: true,
+          homoglyph: true,
+          typosquat: true,
+          combosquat: true,
+        },
+        protectedDomains: [],
+        Action: "block",
+        logDetections: true,
+      },
+
       // Performance settings
       scanDelay: 100,
       maxScanDepth: 10,
@@ -324,16 +355,17 @@ export class ConfigManager {
       version: "1.0.0",
 
       // Visual branding
-      primaryColor: "#2563eb",
+      primaryColor: "#F77F00",
       secondaryColor: "#64748b",
       logoUrl: "images/logo.png",
       faviconUrl: "images/favicon.ico",
 
       // Contact information
-      supportEmail: "support@check.com",
-      supportUrl: "https://support.check.com",
-      privacyPolicyUrl: "https://check.com/privacy",
-      termsOfServiceUrl: "https://check.com/terms",
+      supportEmail: "",
+      supportUrl: "",
+      privacyPolicyUrl: "",
+      aboutUrl: "",
+      termsOfServiceUrl: "",
 
       // Customizable text
       welcomeMessage:
@@ -462,8 +494,12 @@ export class ConfigManager {
       await this.loadConfig();
     }
 
-    // Start with the base branding config
-    let finalBranding = await this.getBrandingConfig();
+    // Start with defaults to ensure required branding links are always available
+    const defaultBranding = this.getDefaultBrandingConfig();
+    let finalBranding = {
+      ...defaultBranding,
+      ...(await this.getBrandingConfig()),
+    };
 
     // If enterprise has custom branding, merge it in (takes precedence)
     if (this.enterpriseConfig && this.enterpriseConfig.customBranding) {
@@ -480,6 +516,11 @@ export class ConfigManager {
       finalBranding.genericWebhook = currentConfig.genericWebhook;
     }
 
+    // Derive support URL when only partial branding is configured
+    if (!finalBranding.supportUrl && finalBranding.supportEmail) {
+      finalBranding.supportUrl = `mailto:${finalBranding.supportEmail}`;
+    }
+
     return finalBranding;
   }
 
diff --git a/scripts/modules/detection-rules-manager.js b/scripts/modules/detection-rules-manager.js
index 97ad58e..ad6d35d 100644
--- a/scripts/modules/detection-rules-manager.js
+++ b/scripts/modules/detection-rules-manager.js
@@ -7,7 +7,7 @@ import { chrome, storage } from "../browser-polyfill.js";
 import logger from "../utils/logger.js";
 
 export class DetectionRulesManager {
-  constructor() {
+  constructor(configManager = null) {
     this.cachedRules = null;
     this.lastUpdate = 0;
     this.updateInterval = 24 * 60 * 60 * 1000; // Default: 24 hours
@@ -16,6 +16,7 @@ export class DetectionRulesManager {
     this.remoteUrl =
       "https://raw.githubusercontent.com/CyberDrain/Check/refs/heads/main/rules/detection-rules.json";
     this.config = null;
+    this.configManager = configManager;
     this.initialized = false;
   }
 
@@ -53,9 +54,14 @@ export class DetectionRulesManager {
 
   async loadConfiguration() {
     try {
-      // Load from chrome storage to get user configuration
-      const result = await storage.local.get(["config"]);
-      this.config = result?.config || {};
+      // Use ConfigManager if available to get merged configuration (enterprise + local)
+      if (this.configManager) {
+        this.config = await this.configManager.getConfig();
+      } else {
+        // Fallback to direct storage access if ConfigManager is not available
+        const result = await storage.local.get(["config"]);
+        this.config = result?.config || {};
+      }
 
       // Set remote URL from configuration or use default
       if (this.config.customRulesUrl) {
diff --git a/scripts/modules/domain-squatting-detector.js b/scripts/modules/domain-squatting-detector.js
new file mode 100644
index 0000000..1edde81
--- /dev/null
+++ b/scripts/modules/domain-squatting-detector.js
@@ -0,0 +1,635 @@
+/**
+ * Domain Squatting Detector Module
+ * Detects typosquatting, homoglyphs, combosquatting, and other domain impersonation techniques
+ */
+
+import logger from '../utils/logger.js';
+
+export class DomainSquattingDetector {
+  constructor() {
+    this.protectedDomains = [];
+    this.enabled = true;
+    this.action = 'block';
+    this.minimumSeverity = 'high';
+    this.logDetections = true;
+    this.deviationThreshold = 2; // Maximum Levenshtein distance
+    this.algorithms = {
+      levenshtein: true,
+      homoglyph: true,
+      typosquat: true,
+      combosquat: true
+    };
+    
+    // Common homoglyphs (confusable characters)
+    this.homoglyphs = {
+      'a': ['à', 'á', 'â', 'ã', 'ä', 'å', 'ā', 'ă', 'ą', 'α', 'а'],
+      'b': ['ḃ', 'ḅ', 'ḇ', 'ь', 'в'],
+      'c': ['ć', 'ĉ', 'ċ', 'ç', 'č', 'ϲ', 'с'],
+      'd': ['ď', 'ḋ', 'ḍ', 'ḏ', 'ḑ', 'ḓ', 'ԁ', 'ժ'],
+      'e': ['è', 'é', 'ê', 'ë', 'ē', 'ĕ', 'ė', 'ę', 'ě', 'е', 'ε'],
+      'g': ['ĝ', 'ğ', 'ġ', 'ģ', 'ց', 'ǥ'],
+      'h': ['ĥ', 'ḣ', 'ḥ', 'ḧ', 'ḩ', 'ḫ', 'һ', 'հ'],
+      'i': ['ì', 'í', 'î', 'ï', 'ĩ', 'ī', 'ĭ', 'į', 'ı', 'і', 'ι'],
+      'j': ['ĵ', 'ј'],
+      'k': ['ķ', 'ḱ', 'ḳ', 'ḵ', 'κ', 'к'],
+      'l': ['ĺ', 'ļ', 'ľ', 'ḷ', 'ḹ', 'ḻ', 'ḽ', 'ӏ', 'ℓ'],
+      'm': ['ḿ', 'ṁ', 'ṃ', 'м', 'ṁ'],
+      'n': ['ñ', 'ń', 'ņ', 'ň', 'ṅ', 'ṇ', 'ṉ', 'ṋ', 'п'],
+      'o': ['ò', 'ó', 'ô', 'õ', 'ö', 'ø', 'ō', 'ŏ', 'ő', 'ο', 'о', 'օ'],
+      'p': ['ṕ', 'ṗ', 'р', 'ρ'],
+      'q': ['ԛ'],
+      'r': ['ŕ', 'ŗ', 'ř', 'ṙ', 'ṛ', 'ṝ', 'ṟ', 'г'],
+      's': ['ś', 'ŝ', 'ş', 'š', 'ṡ', 'ṣ', 'ṥ', 'ṧ', 'ṩ', 'ѕ'],
+      't': ['ţ', 'ť', 'ṫ', 'ṭ', 'ṯ', 'ṱ', 'т', 'τ'],
+      'u': ['ù', 'ú', 'û', 'ü', 'ũ', 'ū', 'ŭ', 'ů', 'ű', 'ų', 'υ', 'и'],
+      'v': ['ṽ', 'ṿ', 'ν', 'ѵ'],
+      'w': ['ŵ', 'ẁ', 'ẃ', 'ẅ', 'ẇ', 'ẉ', 'ẘ', 'ԝ'],
+      'x': ['ẋ', 'ẍ', 'х', 'χ'],
+      'y': ['ý', 'ÿ', 'ŷ', 'ẏ', 'ẙ', 'ỳ', 'ỵ', 'у', 'ү'],
+      'z': ['ź', 'ż', 'ž', 'ẑ', 'ẓ', 'ẕ', 'ᴢ'],
+      '0': ['о', 'ο', 'о', '᧐'],
+      '1': ['l', 'і', 'Ӏ', 'ǀ'],
+      '3': ['з', 'ʒ', 'ȝ'],
+      '5': ['ƽ'],
+      '6': ['б'],
+      '8': ['ց'],
+      '9': ['ԛ', 'ց']
+    };
+    
+    // Reverse lookup for homoglyphs
+    this.homoglyphReverse = {};
+    this.buildReverseHomoglyphMap();
+  }
+  
+  /**
+   * Build reverse lookup map for homoglyphs
+   */
+  buildReverseHomoglyphMap() {
+    for (const [base, variants] of Object.entries(this.homoglyphs)) {
+      for (const variant of variants) {
+        this.homoglyphReverse[variant] = base;
+      }
+    }
+  }
+  
+  /**
+   * Extract domains from URL allowlist patterns
+   * Handles regex patterns, wildcards, and plain URLs/domains
+   */
+  extractDomainsFromAllowlist(allowlist) {
+    if (!Array.isArray(allowlist) || allowlist.length === 0) {
+      return [];
+    }
+    
+    const domains = [];
+    
+    for (const pattern of allowlist) {
+      if (!pattern || typeof pattern !== 'string') continue;
+      
+      try {
+        let domain = null;
+        
+        // Remove regex anchors and escaping
+        let cleaned = pattern.trim()
+          .replace(/^\^/, '')  // Remove leading ^
+          .replace(/\$$/, '')  // Remove trailing $
+          .replace(/\\/g, ''); // Remove escape characters
+        
+        // Try to extract domain from URL pattern
+        // Pattern formats:
+        // - https://example.com/...
+        // - ^https://example\.com$
+        // - *.example.com
+        // - example.com
+        
+        // Extract hostname from URL-like patterns
+        const urlMatch = cleaned.match(/^(?:https?:\/\/)?([a-zA-Z0-9][\w\-\.]*[a-zA-Z0-9])/);
+        if (urlMatch) {
+          domain = urlMatch[1];
+          
+          // Remove wildcards
+          domain = domain.replace(/^\*\./, '');
+          
+          // Remove path and query string indicators
+          domain = domain.split('/')[0].split('?')[0].split('#')[0];
+          
+          // Remove regex patterns like (.*)?
+          domain = domain.replace(/\(.*?\)/g, '');
+          
+          // Remove trailing dots or special chars
+          domain = domain.replace(/[^\w\-\.]/g, '').replace(/\.$/, '');
+          
+          // Validate it looks like a domain
+          if (domain && domain.includes('.') && domain.length > 3) {
+            domains.push(domain.toLowerCase());
+          }
+        }
+      } catch (error) {
+        logger.debug(`Could not extract domain from pattern: ${pattern}`, error);
+      }
+    }
+    
+    // Remove duplicates
+    return [...new Set(domains)];
+  }
+  
+  /**
+   * Initialize with configuration
+   */
+  async initialize(rulesConfig = {}, runtimeConfig = {}) {
+    try {
+      const rulesDomainSquatting = rulesConfig?.domain_squatting || {};
+      const runtimeDomainSquatting = runtimeConfig?.domainSquatting || {};
+
+      this.enabled = runtimeDomainSquatting.enabled !== false;
+      this.protectedDomains = rulesDomainSquatting.protected_domains || [];
+      this.deviationThreshold =
+        runtimeDomainSquatting.deviationThreshold ||
+        rulesDomainSquatting.deviation_threshold ||
+        2;
+      this.action =
+        runtimeDomainSquatting.Action ||
+        runtimeDomainSquatting.action ||
+        rulesDomainSquatting.action ||
+        'block';
+      this.minimumSeverity =
+        runtimeDomainSquatting.severity ||
+        rulesDomainSquatting.severity ||
+        'high';
+      this.logDetections =
+        runtimeDomainSquatting.logDetections !== undefined
+          ? runtimeDomainSquatting.logDetections
+          : rulesDomainSquatting.log_detections !== false;
+
+      this.algorithms = {
+        ...this.algorithms,
+        ...(rulesDomainSquatting.algorithms || {}),
+        ...(runtimeDomainSquatting.algorithms || {}),
+      };
+
+      // Extract domains from URL allowlist patterns from runtime config
+      const urlAllowlist = runtimeConfig?.urlAllowlist || [];
+      
+      // Extract domains from URL allowlist patterns
+      const allowlistDomains = this.extractDomainsFromAllowlist(urlAllowlist);
+      if (allowlistDomains.length > 0) {
+        // Merge with protected domains from rules (avoid duplicates)
+        const allDomains = [...new Set([...this.protectedDomains, ...allowlistDomains])];
+        this.protectedDomains = allDomains;
+        logger.log(`Added ${allowlistDomains.length} domains from URL allowlist`);
+      }
+      
+      logger.log('DomainSquattingDetector initialized:', {
+        enabled: this.enabled,
+        action: this.action,
+        minimumSeverity: this.minimumSeverity,
+        logDetections: this.logDetections,
+        protectedDomains: this.protectedDomains.length,
+        fromRules: rulesDomainSquatting?.protected_domains?.length || 0,
+        fromAllowlist: allowlistDomains.length,
+        deviationThreshold: this.deviationThreshold
+      });
+    } catch (error) {
+      logger.error('Failed to initialize DomainSquattingDetector:', error);
+    }
+  }
+  
+  /**
+   * Update configuration
+   */
+  updateConfig(config) {
+    if (config.enabled !== undefined) {
+      this.enabled = config.enabled;
+    }
+    if (config.protected_domains || config.protectedDomains) {
+      this.protectedDomains = config.protected_domains || config.protectedDomains;
+    }
+    if (config.action || config.Action) {
+      this.action = config.action || config.Action;
+    }
+    if (config.severity) {
+      this.minimumSeverity = config.severity;
+    }
+    if (config.logDetections !== undefined) {
+      this.logDetections = config.logDetections;
+    }
+    if (config.deviation_threshold !== undefined || config.deviationThreshold !== undefined) {
+      this.deviationThreshold = config.deviation_threshold !== undefined
+        ? config.deviation_threshold
+        : config.deviationThreshold;
+    }
+    if (config.algorithms) {
+      this.algorithms = { ...this.algorithms, ...config.algorithms };
+    }
+  }
+
+  getAction() {
+    return this.action || 'block';
+  }
+
+  getSeverityRank(severity) {
+    const rank = {
+      low: 1,
+      medium: 2,
+      high: 3,
+      critical: 4
+    };
+    return rank[String(severity || '').toLowerCase()] || 1;
+  }
+
+  getActionForSeverity(severity) {
+    const configuredAction = this.getAction();
+    if (configuredAction !== 'block') {
+      return configuredAction;
+    }
+
+    const minimumRank = this.getSeverityRank(this.minimumSeverity || 'high');
+    const detectedRank = this.getSeverityRank(severity);
+    return detectedRank >= minimumRank ? 'block' : 'warn';
+  }
+
+  shouldLogDetections() {
+    return this.logDetections !== false;
+  }
+
+  checkDomain(testDomain) {
+    if (!this.enabled || !testDomain) {
+      return null;
+    }
+
+    const testBase = this.extractBaseDomain(testDomain);
+
+    for (const protectedDomain of this.protectedDomains) {
+      const protectedBase = this.extractBaseDomain(protectedDomain);
+
+      if (testBase === protectedBase) {
+        continue;
+      }
+
+      const detections = [];
+
+      if (this.algorithms.levenshtein) {
+        const levenshteinResult = this.detectLevenshtein(testBase, protectedBase);
+        if (levenshteinResult) {
+          detections.push(levenshteinResult);
+        }
+      }
+
+      if (this.algorithms.homoglyph) {
+        const homoglyphResult = this.detectHomoglyph(testBase, protectedBase);
+        if (homoglyphResult) {
+          detections.push(homoglyphResult);
+        }
+      }
+
+      if (this.algorithms.typosquat) {
+        const typosquatResult = this.detectTyposquat(testBase, protectedBase);
+        if (typosquatResult) {
+          detections.push(typosquatResult);
+        }
+      }
+
+      if (this.algorithms.combosquat) {
+        const combosquatResult = this.detectCombosquat(testBase, protectedBase);
+        if (combosquatResult) {
+          detections.push(combosquatResult);
+        }
+      }
+
+      if (detections.length > 0) {
+        const severity = this.calculateSeverity(detections);
+        return {
+          detected: true,
+          testDomain: testDomain,
+          protectedDomain: protectedDomain,
+          techniques: detections,
+          severity,
+          confidence: this.calculateConfidence(detections),
+          action: this.getActionForSeverity(severity),
+        };
+      }
+    }
+
+    return null;
+  }
+  
+  /**
+   * Extract base domain without subdomain and TLD
+   */
+  extractBaseDomain(domain) {
+    if (!domain) return '';
+    
+    // Remove protocol
+    domain = domain.replace(/^https?:\/\//, '');
+    
+    // Remove path
+    domain = domain.split('/')[0];
+    
+    // Remove port
+    domain = domain.split(':')[0];
+    
+    // Split by dots
+    const parts = domain.split('.');
+    
+    // Get the main domain part (second-to-last typically)
+    if (parts.length >= 2) {
+      // Handle common two-part TLDs like .co.uk, .com.au
+      if (parts.length >= 3 && ['co', 'com', 'net', 'org', 'gov', 'edu'].includes(parts[parts.length - 2])) {
+        return parts[parts.length - 3];
+      }
+      return parts[parts.length - 2];
+    }
+    
+    return parts[0] || '';
+  }
+  
+  /**
+   * Calculate Levenshtein distance between two strings
+   */
+  levenshteinDistance(str1, str2) {
+    const matrix = [];
+    
+    for (let i = 0; i <= str2.length; i++) {
+      matrix[i] = [i];
+    }
+    
+    for (let j = 0; j <= str1.length; j++) {
+      matrix[0][j] = j;
+    }
+    
+    for (let i = 1; i <= str2.length; i++) {
+      for (let j = 1; j <= str1.length; j++) {
+        if (str2.charAt(i - 1) === str1.charAt(j - 1)) {
+          matrix[i][j] = matrix[i - 1][j - 1];
+        } else {
+          matrix[i][j] = Math.min(
+            matrix[i - 1][j - 1] + 1, // substitution
+            matrix[i][j - 1] + 1,     // insertion
+            matrix[i - 1][j] + 1      // deletion
+          );
+        }
+      }
+    }
+    
+    return matrix[str2.length][str1.length];
+  }
+  
+  /**
+   * Detect domain squatting using Levenshtein distance
+   */
+  detectLevenshtein(testDomain, protectedDomain) {
+    const distance = this.levenshteinDistance(testDomain, protectedDomain);
+    
+    if (distance > 0 && distance <= this.deviationThreshold) {
+      return {
+        technique: 'levenshtein',
+        description: `Domain differs by ${distance} character(s) from protected domain`,
+        distance: distance,
+        confidence: 1 - (distance / this.deviationThreshold)
+      };
+    }
+    
+    return null;
+  }
+  
+  /**
+   * Normalize domain by replacing homoglyphs with standard characters
+   */
+  normalizeHomoglyphs(domain) {
+    let normalized = '';
+    for (const char of domain) {
+      normalized += this.homoglyphReverse[char] || char;
+    }
+    return normalized;
+  }
+  
+  /**
+   * Detect homoglyph substitution
+   */
+  detectHomoglyph(testDomain, protectedDomain) {
+    const normalized = this.normalizeHomoglyphs(testDomain);
+    
+    if (normalized !== testDomain && normalized === protectedDomain) {
+      return {
+        technique: 'homoglyph',
+        description: 'Domain uses confusable characters (homoglyphs) to mimic protected domain',
+        original: testDomain,
+        normalized: normalized,
+        confidence: 0.95
+      };
+    }
+    
+    // Also check if normalized version is close to protected domain
+    const distance = this.levenshteinDistance(normalized, protectedDomain);
+    if (normalized !== testDomain && distance > 0 && distance <= this.deviationThreshold) {
+      return {
+        technique: 'homoglyph',
+        description: 'Domain uses confusable characters and differs slightly from protected domain',
+        original: testDomain,
+        normalized: normalized,
+        distance: distance,
+        confidence: 0.85 - (distance * 0.1)
+      };
+    }
+    
+    return null;
+  }
+  
+  /**
+   * Detect common typosquatting patterns
+   */
+  detectTyposquat(testDomain, protectedDomain) {
+    // Check for character swaps (transposition)
+    for (let i = 0; i < protectedDomain.length - 1; i++) {
+      const swapped = protectedDomain.substring(0, i) +
+                      protectedDomain.charAt(i + 1) +
+                      protectedDomain.charAt(i) +
+                      protectedDomain.substring(i + 2);
+      
+      if (swapped === testDomain) {
+        return {
+          technique: 'typosquat',
+          description: 'Domain has swapped adjacent characters',
+          pattern: 'character_swap',
+          position: i,
+          confidence: 0.9
+        };
+      }
+    }
+    
+    // Check for missing character
+    for (let i = 0; i < protectedDomain.length; i++) {
+      const missing = protectedDomain.substring(0, i) + protectedDomain.substring(i + 1);
+      
+      if (missing === testDomain) {
+        return {
+          technique: 'typosquat',
+          description: 'Domain is missing a character',
+          pattern: 'character_omission',
+          position: i,
+          confidence: 0.85
+        };
+      }
+    }
+    
+    // Check for duplicate character
+    for (let i = 0; i < protectedDomain.length; i++) {
+      const duplicated = protectedDomain.substring(0, i + 1) +
+                         protectedDomain.charAt(i) +
+                         protectedDomain.substring(i + 1);
+      
+      if (duplicated === testDomain) {
+        return {
+          technique: 'typosquat',
+          description: 'Domain has a duplicated character',
+          pattern: 'character_duplication',
+          position: i,
+          confidence: 0.85
+        };
+      }
+    }
+    
+    // Check for adjacent key substitution (common keyboard mistakes)
+    const keyboardAdjacent = {
+      'q': ['w', 'a'],
+      'w': ['q', 'e', 's', 'a'],
+      'e': ['w', 'r', 'd', 's'],
+      'r': ['e', 't', 'f', 'd'],
+      't': ['r', 'y', 'g', 'f'],
+      'y': ['t', 'u', 'h', 'g'],
+      'u': ['y', 'i', 'j', 'h'],
+      'i': ['u', 'o', 'k', 'j'],
+      'o': ['i', 'p', 'l', 'k'],
+      'p': ['o', 'l'],
+      'a': ['q', 'w', 's', 'z'],
+      's': ['a', 'w', 'd', 'x', 'z'],
+      'd': ['s', 'e', 'f', 'c', 'x'],
+      'f': ['d', 'r', 'g', 'v', 'c'],
+      'g': ['f', 't', 'h', 'b', 'v'],
+      'h': ['g', 'y', 'j', 'n', 'b'],
+      'j': ['h', 'u', 'k', 'm', 'n'],
+      'k': ['j', 'i', 'l', 'm'],
+      'l': ['k', 'o', 'p'],
+      'z': ['a', 's', 'x'],
+      'x': ['z', 's', 'd', 'c'],
+      'c': ['x', 'd', 'f', 'v'],
+      'v': ['c', 'f', 'g', 'b'],
+      'b': ['v', 'g', 'h', 'n'],
+      'n': ['b', 'h', 'j', 'm'],
+      'm': ['n', 'j', 'k']
+    };
+    
+    for (let i = 0; i < protectedDomain.length; i++) {
+      const char = protectedDomain.charAt(i);
+      const adjacentKeys = keyboardAdjacent[char] || [];
+      
+      for (const adjacentKey of adjacentKeys) {
+        const substituted = protectedDomain.substring(0, i) +
+                           adjacentKey +
+                           protectedDomain.substring(i + 1);
+        
+        if (substituted === testDomain) {
+          return {
+            technique: 'typosquat',
+            description: 'Domain has keyboard-adjacent character substitution',
+            pattern: 'adjacent_key_substitution',
+            position: i,
+            original: char,
+            substituted: adjacentKey,
+            confidence: 0.8
+          };
+        }
+      }
+    }
+    
+    return null;
+  }
+  
+  /**
+   * Detect combosquatting (adding prefixes/suffixes)
+   */
+  detectCombosquat(testDomain, protectedDomain) {
+    // Check if protected domain is contained in test domain
+    if (testDomain.includes(protectedDomain) && testDomain !== protectedDomain) {
+      const prefix = testDomain.substring(0, testDomain.indexOf(protectedDomain));
+      const suffix = testDomain.substring(testDomain.indexOf(protectedDomain) + protectedDomain.length);
+      
+      // Common combosquatting prefixes and suffixes
+      const commonCombos = [
+        'secure', 'login', 'account', 'verify', 'support', 'help', 'my',
+        'auth', 'sso', 'signin', 'app', 'portal', 'online', 'web',
+        'mobile', 'service', 'official', 'verified', 'safe'
+      ];
+      
+      const hasCommonCombo = commonCombos.some(combo => 
+        prefix.includes(combo) || suffix.includes(combo)
+      );
+      
+      if (hasCommonCombo) {
+        return {
+          technique: 'combosquat',
+          description: 'Domain adds suspicious prefix/suffix to protected domain',
+          pattern: 'common_combo',
+          prefix: prefix,
+          suffix: suffix,
+          confidence: 0.9
+        };
+      }
+      
+      // Any prefix/suffix is suspicious but lower confidence
+      if (prefix || suffix) {
+        return {
+          technique: 'combosquat',
+          description: 'Domain adds prefix/suffix to protected domain',
+          pattern: 'generic_combo',
+          prefix: prefix,
+          suffix: suffix,
+          confidence: 0.7
+        };
+      }
+    }
+    
+    // Check if test domain contains protected domain with separator
+    const separators = ['-', '_', ''];
+    for (const sep of separators) {
+      if (testDomain.startsWith(protectedDomain + sep) || testDomain.endsWith(sep + protectedDomain)) {
+        return {
+          technique: 'combosquat',
+          description: `Domain adds text with separator '${sep || '(none)'}' to protected domain`,
+          pattern: 'separator_combo',
+          separator: sep,
+          confidence: 0.75
+        };
+      }
+    }
+    
+    return null;
+  }
+  
+  /**
+   * Calculate overall severity based on detections
+   */
+  calculateSeverity(detections) {
+    const maxConfidence = Math.max(...detections.map(d => d.confidence));
+    
+    if (maxConfidence >= 0.9) return 'critical';
+    if (maxConfidence >= 0.8) return 'high';
+    if (maxConfidence >= 0.6) return 'medium';
+    return 'low';
+  }
+  
+  /**
+   * Calculate overall confidence based on detections
+   */
+  calculateConfidence(detections) {
+    if (detections.length === 0) return 0;
+    
+    // If multiple techniques detected, increase confidence
+    const avgConfidence = detections.reduce((sum, d) => sum + d.confidence, 0) / detections.length;
+    const multiTechniqueBonus = detections.length > 1 ? 0.1 : 0;
+    
+    return Math.min(0.99, avgConfidence + multiTechniqueBonus);
+  }
+}
+
+export default DomainSquattingDetector;
diff --git a/tests/config-persistence.test.js b/tests/config-persistence.test.js
index b991d5f..e0630e0 100644
--- a/tests/config-persistence.test.js
+++ b/tests/config-persistence.test.js
@@ -235,3 +235,50 @@ test('ConfigManager - merge precedence', async (t) => {
   delete global.fetch;
   teardownGlobalChrome();
 });
+
+test('ConfigManager - branding links for manual and enterprise config', async (t) => {
+  const chromeMock = setupGlobalChrome();
+
+  global.fetch = async () => ({
+    ok: false,
+    status: 404
+  });
+
+  const { ConfigManager } = await import('../scripts/modules/config-manager.js');
+
+  await t.test('should honor explicit support/privacy/about URLs from enterprise custom branding', async () => {
+    chromeMock.storage.managed.set({
+      customBranding: {
+        supportUrl: 'https://enterprise.example/support',
+        privacyPolicyUrl: 'https://enterprise.example/privacy',
+        aboutUrl: 'https://enterprise.example/about'
+      }
+    });
+
+    const configManager = new ConfigManager();
+    const branding = await configManager.getFinalBrandingConfig();
+
+    assert.strictEqual(branding.supportUrl, 'https://enterprise.example/support');
+    assert.strictEqual(branding.privacyPolicyUrl, 'https://enterprise.example/privacy');
+    assert.strictEqual(branding.aboutUrl, 'https://enterprise.example/about');
+  });
+
+  await t.test('should derive support link from supportEmail when URLs are not set', async () => {
+    await chromeMock.storage.local.set({
+      brandingConfig: {
+        supportEmail: 'help@manual.example'
+      }
+    });
+
+    const configManager = new ConfigManager();
+    const branding = await configManager.getFinalBrandingConfig();
+    const defaultBranding = configManager.getDefaultBrandingConfig();
+
+    assert.strictEqual(branding.supportUrl, 'mailto:help@manual.example');
+    assert.strictEqual(branding.privacyPolicyUrl, defaultBranding.privacyPolicyUrl);
+    assert.strictEqual(branding.aboutUrl, defaultBranding.aboutUrl);
+  });
+
+  delete global.fetch;
+  teardownGlobalChrome();
+});