Extract disabledResult and evidenceEval helpers to reduce boilerplate

Add two shared helpers to source.go and apply them across all sources:
- disabledResult(id, name) replaces the repeated inline SourceResult literal
- evidenceEval(r, severity) replaces the identical Evaluate body in 6 sources

checker/dnsbl.go

@@ -93,9 +93,7 @@ var DefaultDNSBLZones = []DNSBLZone{
 func (s *dnsblSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	zones := zonesFromOptions(opts)
 	if registered == "" || len(zones) == 0 {
-		return []SourceResult{{
+		return disabledResult(s.ID(), s.Name())
-			SourceID: s.ID(), SourceName: s.Name(), Enabled: false,
-		}}
 	}
 
 	out := make([]SourceResult, len(zones))

checker/malwarebazaar.go

@@ -48,7 +48,7 @@ func (*malwareBazaarSource) Options() SourceOptions {
 func (s *malwareBazaarSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	authKey := stringOpt(opts, "malwarebazaar_auth_key")
 	if !sdk.GetBoolOption(opts, "enable_malwarebazaar", true) || registered == "" || authKey == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 
 	res := SourceResult{
@@ -129,10 +129,7 @@ func (s *malwareBazaarSource) Query(ctx context.Context, domain, registered stri
 }
 
 func (*malwareBazaarSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityWarn)
-		return true, SeverityWarn
-	}
-	return false, ""
 }
 
 func (*malwareBazaarSource) Diagnose(res SourceResult) Diagnosis {

checker/openphish.go

@@ -47,7 +47,7 @@ func (*openPhishSource) Options() SourceOptions {
 
 func (s *openPhishSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	if !sdk.GetBoolOption(opts, "enable_openphish", true) || registered == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 
 	urls, size, fetched, err := s.cache.lookup(ctx, registered)
@@ -70,10 +70,7 @@ func (s *openPhishSource) Query(ctx context.Context, domain, registered string,
 }
 
 func (*openPhishSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityCrit)
-		return true, SeverityCrit
-	}
-	return false, ""
 }
 
 func (*openPhishSource) Diagnose(res SourceResult) Diagnosis {

checker/phishtank.go

@@ -54,7 +54,7 @@ func (*phishTankSource) Options() SourceOptions {
 
 func (s *phishTankSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	if !sdk.GetBoolOption(opts, "enable_phishtank", true) || registered == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 
 	if ttlRaw, ok := sdk.GetOption[string](opts, "phishtank_refresh_hours"); ok && ttlRaw != "" {
@@ -82,10 +82,7 @@ func (s *phishTankSource) Query(ctx context.Context, domain, registered string,
 }
 
 func (*phishTankSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityCrit)
-		return true, SeverityCrit
-	}
-	return false, ""
 }
 
 func (*phishTankSource) Diagnose(res SourceResult) Diagnosis {

checker/safebrowsing.go

@@ -54,7 +54,7 @@ func (*safeBrowsingSource) Options() SourceOptions {
 func (s *safeBrowsingSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	apiKey := stringOpt(opts, "google_safe_browsing_api_key")
 	if apiKey == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 	if registered == "" {
 		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: true}}
@@ -142,10 +142,7 @@ func (s *safeBrowsingSource) Query(ctx context.Context, domain, registered strin
 }
 
 func (*safeBrowsingSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityCrit)
-		return true, SeverityCrit
-	}
-	return false, ""
 }
 
 func (*safeBrowsingSource) Diagnose(res SourceResult) Diagnosis {

checker/source.go

@@ -152,6 +152,20 @@ func Sources() []Source {
 	return out
 }
 
+// disabledResult returns the standard "source is disabled" sentinel slice.
+func disabledResult(id, name string) []SourceResult {
+	return []SourceResult{{SourceID: id, SourceName: name, Enabled: false}}
+}
+
+// evidenceEval is the common Evaluate body: listed when there is at least
+// one Evidence entry and no error.
+func evidenceEval(r SourceResult, severity string) (bool, string) {
+	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+		return true, severity
+	}
+	return false, ""
+}
+
 // EvaluateResult looks up the source that produced r from the registry
 // and delegates to its Evaluate method. Returns (false, "") when the
 // source is not found — a safe default that never promotes a stale

checker/threatfox.go

@@ -48,7 +48,7 @@ func (*threatFoxSource) Options() SourceOptions {
 func (s *threatFoxSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	authKey := stringOpt(opts, "threatfox_auth_key")
 	if !sdk.GetBoolOption(opts, "enable_threatfox", true) || registered == "" || authKey == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 
 	res := SourceResult{
@@ -135,10 +135,7 @@ func (s *threatFoxSource) Query(ctx context.Context, domain, registered string,
 }
 
 func (*threatFoxSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityCrit)
-		return true, SeverityCrit
-	}
-	return false, ""
 }
 
 func (*threatFoxSource) Diagnose(res SourceResult) Diagnosis {

checker/urlhaus.go

@@ -67,7 +67,7 @@ type urlhausURL struct {
 func (s *urlhausSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	authKey := stringOpt(opts, "urlhaus_auth_key")
 	if !sdk.GetBoolOption(opts, "enable_urlhaus", true) || registered == "" || authKey == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 
 	res := SourceResult{SourceID: s.ID(), SourceName: s.Name(), Enabled: true}
@@ -147,10 +147,7 @@ func (s *urlhausSource) Query(ctx context.Context, domain, registered string, op
 }
 
 func (*urlhausSource) Evaluate(r SourceResult) (bool, string) {
-	if r.Enabled && r.Error == "" && len(r.Evidence) > 0 {
+	return evidenceEval(r, SeverityCrit)
-		return true, SeverityCrit
-	}
-	return false, ""
 }
 
 func (*urlhausSource) Diagnose(res SourceResult) Diagnosis {

checker/virustotal.go

@@ -60,7 +60,7 @@ type vtVendorVerdict struct {
 func (s *virusTotalSource) Query(ctx context.Context, domain, registered string, opts sdk.CheckerOptions) []SourceResult {
 	apiKey := stringOpt(opts, "virustotal_api_key")
 	if apiKey == "" {
-		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: false}}
+		return disabledResult(s.ID(), s.Name())
 	}
 	if registered == "" {
 		return []SourceResult{{SourceID: s.ID(), SourceName: s.Name(), Enabled: true}}