📦 This tool now lives in clearbox

It has been merged into a single toolkit with six sibling tools, sharing one design and one bilingual (EN/AR) interface.

→ Use it here: https://wedo911.github.io/clearbox/tools/scam/

This repository stays up so existing links keep working, but development continues in clearbox.

---

scamlens

A small web app that reads a suspicious message (SMS, email, WhatsApp, DM — in English or Arabic) and explains, in plain language, which scam red flags it contains. Everything runs client-side. Nothing you paste is ever sent to a server, logged, or tracked — there is no backend at all.

Live site: https://wedo911.github.io/scamlens/

Why

Scam and phishing messages follow a small set of recurring tactics: fake urgency, credential-harvesting links, prize lures, requests for gift cards or one-time codes, lookalike domains. Anyone can learn to spot these — but most detection tools are English-only, require an account, or send your message to a third-party server (a bad idea when the message itself might contain sensitive context). scamlens is meant for the person who just got a worrying text and wants a fast, private, judgment-free second opinion — including the large population of Arabic speakers most existing tools don't support at all.

How it works

Pure heuristic pattern matching — regex rules plus structural URL analysis (shortened links, IP-address links, punycode, brand-lookalike domains) — scored into a 0-100 risk gauge with the specific phrases responsible highlighted directly in your message. No machine learning model, no API call, no dependency of any kind. Read the entire detection engine in one file: js/heuristics.mjs.

Detected categories:

Category	Example
urgency_pressure	"your account will be suspended within 24 hours"
credential_phishing	"click here to verify your account"
prize_lure	"congratulations, you've won"
financial_request	"send us the verification code" / gift cards / wire transfers
impersonation	fake delivery/customs/bank-department language
personal_info_request	asks for card number, CVV, national ID
too_good_to_be_true	guaranteed investment returns
suspicious_link	shortened links, raw IP-address links, punycode, brand-lookalike domains (e.g. paypal-secure-login.com)

Every rule exists in both English and Arabic; contributions adding other languages are very welcome.

Run it locally

It's a static site — no build step, no install:

python -m http.server 8000
# open http://localhost:8000

Or open index.html directly in a browser (the service worker won't register from file://, but the analyzer works fine either way).

Run the tests

node --test tests/heuristics.test.mjs

What this is not

• Not a guarantee of safety. It flags known tactics; it will miss novel phrasing and can occasionally flag a legitimate but urgently-worded message. Treat a clean result as "no obvious red flags," not "verified safe."
• Not a URL reputation database (no Safe Browsing-style lookups) — by design, since that would require sending data off-device.
• Not a replacement for verifying independently through a channel you already trust.

Contributing

New scam patterns, additional languages, and false-positive reports are all welcome — open an issue or a PR against js/heuristics.mjs.

License

MIT — see LICENSE.