Brand Guard

Text before you trust it. Send Brand Guard a link, screenshot, video or receipt in iMessage and get Legit / Not legit / Couldn't check, with proof, the real store, and what to do if you paid.

Comment

Inspiration: the horse is still at the gate

Three thousand years ago, Troy didn't fall to a battering ram. It fell to a gift it chose to trust. The walls held for ten years; the gate opened in one night.

The gift looks different now. It arrives at 11:47 PM, between a friend's sunset photo and a plate of wings: a sponsored post, a $39.99 pair of sneakers that should cost $115, only 3 left, DM to order, Zelle only. It looks perfect. That's the point. Generative AI has made the horse beautiful.

Last year, Americans lost $2.1 billion to scams that started on social media, eight times more than in 2020 (FTC Data Spotlight, April 2026), and fake shopping ads are the most reported kind. Not one of those dollars was taken by force. Every one of them was handed over in the same small moment: the few seconds between this looks legit and pay. In that moment nobody runs a domain lookup. They text a friend, and the friend guesses.

We built Brand Guard for that moment.

What it does: check the horse before you open the gate

Brand Guard is a friend in your messages who actually checks. Before you pay, you text it whatever you're looking at, in iMessage or on the web page:

  • a link to a shop, a product, a post or an account (Instagram, TikTok, Facebook, X, YouTube, Pinterest, Threads);
  • a store's name ("is Lucky Fours legit?");
  • a screenshot or screen recording of the ad (it reads the words, the @account, the price, and the tells, like "DM to order, Zelle only");
  • a receipt or order confirmation PDF (it finds the seller);
  • a product photo with no link (it weighs the price against trusted stores).

It answers in plain words, one of three: LEGIT ✅, NOT LEGIT ❌ or COULDN'T CHECK ⚠️. It never pretends. When there is nothing to judge by, it says so, and tells you what to send instead.

Each answer carries its evidence, so a hunch becomes something you can hold:

  • Up to three reasons, each with proof you can open yourself: when the domain was born, what Google Safe Browsing says about it, the exact words it read in your screenshot, the reviews and followers a real store leaves behind.
  • The real brand and trusted places to buy, with prices, so walking away from the fake still leads somewhere.
  • The crowd: "👥 Checked 37 times this week; 31 came out Not legit." Nobody has to face the gate alone.
  • "Already paid?": on a Not legit answer, the next steps for the way you paid (card, PayPal, Zelle, Cash App, crypto, gift cards) and where to report it.

The scam lives in the feed and the DMs. Now the check lives there too.

Agents in iMessage (Photon)

Brand Guard is an agent that lives in iMessage, built on Photon's Spectrum (spectrum-ts, open source), in imessage-agent/. You text it like a person: a link, a store's name, a screenshot, a screen recording or a receipt. It writes back like a friend who did the homework: the verdict, the proof, the real store, and what to do if you already paid. It handles several questions in one message, sends "Double checking…" when an answer takes more than 15 seconds, and asks for a screenshot when a platform hides a post behind a login. No app to download, no account to make: the check happens in the same thread where the link arrived.

How we built it

  • The checks (Python, FastAPI): RDAP for domain age and registrar (a domain under 30 days old is Not legit on its own), Google Safe Browsing and PhishStats, DNS/IP lookups for who runs the server, the page itself (and the Wayback Machine when the live page hides), web search (Brave, You.com, DuckDuckGo) for reviews, followers and discussion threads, oEmbed for social posts, and reverse image search for the same product photo on other shops.
  • Reading what people actually send: RapidOCR for screenshots, OpenCV to pick the distinct frames out of a screen recording, PyMuPDF for receipts (text, link targets, OCR for scanned ones).
  • Rules you can read, not a black box: a score of 35 or more is Not legit, and every rule has a test that fails without it (324 Python tests, offline, in CI on every pull request). That's why every answer can show its proof.
  • The iMessage agent (TypeScript) on Photon's Spectrum SDK: a thin service that calls the API and writes back like a friend. It answers several questions in one message, sends "Double checking…" when an answer takes more than 15 seconds, and asks for a screenshot when a platform hides a post behind a login.
  • A web page with the same answers for anyone not on iMessage.

Challenges we ran into

  • The evidence hides. Instagram and others send logged-out visitors to a sign-in page. We catch the redirect and ask for a screenshot rather than judge an empty room and call it safe.
  • Silence is not innocence. "We found nothing bad" and "we found nothing at all" look alike, and confusing them is how checkers wave a horse through. So Couldn't check became its own answer, with its own rule.
  • Screen recordings repeat themselves. Perceptual hashes merged screens with different words, so we compare changed pixels and keep only the frames worth reading.
  • Search APIs ration their answers. The checks run in parallel with fallbacks, so one slow source never holds the gate.

Accomplishments that we're proud of

  • It reads what people actually see: ads, screenshots, screen recordings and receipts, not just URLs.
  • Every reason comes with proof a shopper can open and a judge can verify.
  • It's honest about doubt. Three answers, never a guess.
  • A bad answer isn't a dead end. The real store and the "Already paid?" steps give the next move.

What we learned

Walls were never the problem. Browsers have HTTPS, banks have fraud teams, phones have Face ID. The problem is the gate, and the gate is a person deciding, alone, in a few seconds, whether to trust something beautiful. Defending that moment doesn't take one clever model. It takes many honest lookups, rules you can explain, and an answer that arrives where the decision is made: in the chat, before the money moves.

What's next

  • Open the iMessage number to everyone, with per-user rate limits.
  • Grow the crowd: every check makes the next person's answer stronger.
  • Let real brands pay for it: brands pay to be listed first among the trusted places to buy, and to get takedown reports for fakes of their products (the first version lives at /lab in the repo).
  • More platforms and marketplaces.

Built at Hacklanta (disclosure)

All of the project's code was written during Hacklanta. The first commit is 44817a3 on Oct 10, 2026 at 10:20 CT, and the full history is public on GitHub. We used open-source libraries (FastAPI, OpenCV, PyMuPDF, RapidOCR, Photon Spectrum and others in requirements.txt and imessage-agent/package.json) and free public data sources (RDAP, Google Safe Browsing, Wayback Machine, Brave Search, You.com, DuckDuckGo). The code was written with help from an AI coding assistant (Anthropic's Claude Code). The video's opening film (0:00 to 1:30) was also generated with code. The real product, recorded live at Hacklanta, starts at 1:33.

For judges

  • Live demo at our table: the web page and the iMessage agent run on the laptop. Bring a link, a screenshot or a store name.
  • Run it yourself: see README.md ("Run it"). It works without API keys, with fewer sources. The iMessage agent opens a terminal chat when no Spectrum credentials are set.
  • Good test inputs: https://testsafebrowsing.appspot.com/s/phishing.html (Not legit, Google Safe Browsing), allbirds.com (Legit), "is Lucky Fours legit?" (finds the store's own site).
  • No accounts or test credentials are needed.

Built With

Share this project:

Updates

Submission history