Hopefully they have it just returning a simple boolean result for whether page is suspicious, and no tool calling.

If I had a tool which could determine whether a page was suspicious, why would I need an LLM to call it?