How ScamCheck Works
ScamCheck does not simply send user submissions to an AI model and ask “Is this a scam?” We use a rigorous, multi-layered deterministic security pipeline.
The 6-Stage Detection Pipeline
Input Normalization & Sanitization
Incoming targets (URLs, messages, emails, or QR codes) are validated, stripped of dangerous payloads, and decomposed into structured syntax tokens.
SSRF & Network Shield Verification
Before any server-side probe occurs, destinations are validated against RFC private ranges, internal DNS suffixes, and cloud metadata targets to prevent Server-Side Request Forgery.
Structural & Heuristic Inspection
Examines Punycode homoglyphs, brand typosquatting, high-abuse TLDs, excessive subdomains, unencrypted login endpoints, and social engineering coercion patterns.
Multi-Provider Threat Intelligence
Parallel queries check global malware blocklists, known phishing databases, and reputation registries (Safe Browsing, VirusTotal, AVENTIQ Threat Lab).
Deterministic Risk Engine
A weighted rules engine scores each verified signal deterministically (0-100), mapping evidence to: LOW RISK, SUSPICIOUS, HIGH RISK, or UNKNOWN.
Evidence-Based AI Synthesis
AI never decides if something is malicious. It only consumes structured findings from the security engine to synthesize clear, non-technical explanations and advice.
Server-Side SSRF & DNS Rebinding Shields
Zero access to internal infrastructure or private subnets
ScamCheck never visits suspicious URLs directly in the user's browser. All preliminary probes happen server-side in an isolated sandbox. To prevent Server-Side Request Forgery (SSRF) and DNS rebinding attacks:
- Blocks localhost (127.0.0.0/8) & ::1
- Blocks private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Blocks AWS/GCP cloud metadata endpoints (169.254.169.254)
- DNS re-validation before each redirect hop
Our Four Primary Classifications
No significant suspicious indicators or known threat intelligence records were detected.
One or more anomalies require caution. The content exhibits traits common in deceptive campaigns.
Multiple strong indicators suggest active phishing, malware, or brand impersonation.
Insufficient verifiable evidence exists. ScamCheck never guesses when evidence is scarce.