Under the hood

How ScamLens works.

ScamLens AI is a pattern-matching engine that runs entirely in your browser. No machine learning, no cloud APIs, no data sent anywhere.

The analysis pipeline

01
You paste, nothing is sent
When you paste a message or URL, it stays in your browser's memory only. ScamLens never makes a network request to analyze your content.
02
Signal detection via pattern matching
The analyzer checks your input against a library of signals: urgency phrases, threat language, requests for sensitive data, suspicious URL patterns, brand impersonation keywords, and more.
03
Score calculation
Each matched signal carries a risk weight. The total is summed and clamped to a 0–100 score. Signals that overlap reinforce the overall risk.
04
Risk level assignment
Scores below 30 are LOW risk. 30–65 is MEDIUM. Above 65 is HIGH. These thresholds are calibrated to minimize false negatives on known scam formats.
05
Actionable guidance
Based on which signals fired, ScamLens generates specific recommendations — not generic advice, but actions tied to what was actually detected.

These are the categories of risk signals ScamLens checks for in message and email text.

Urgency / time pressure language

Threat or legal intimidation

Requests for OTP, PIN, or password

Requests for card or bank details

Unsolicited payment requests

Prize, lottery, or reward claims

Suspicious job or income offers

Brand impersonation (banks, delivery, etc.)

Shortened URLs in message body

Raw IP address links

No requests are made to the URL. Analysis is based entirely on the URL structure and content.

HTTP (non-HTTPS) connection

Raw IP address as hostname

Known URL shortener domains

Unusually long URLs (obfuscation)

@ character in URL

Punycode / homograph domains

Excessive subdomain nesting

Phishing keywords in path (login, verify…)

Suspicious TLDs (.tk, .ml, .xyz…)

Non-standard ports

Heavy URL encoding

Brand lookalike domain names

ScamLens is not a substitute for professional cybersecurity advice or tools.

Pattern matching cannot catch all scams — sophisticated attacks may evade detection.

Language support is primarily English, with partial coverage of common Indian brand names.

LOW risk does not mean safe. Always verify through official channels when in doubt.

URLs are analyzed structurally only — the actual page content is never fetched.