SiagaChat: Scam Link Checker

• 

  safe

Inspiration

Scam links spread through chat apps every day: fake parcel receipts, fake prize notices, fake bank "verification" pages, loan apps and malicious APK files. In Indonesia many of them imitate familiar brands like BCA, Shopee, JNE and DANA. Most people cannot tell shopee.co.id from shopee-hadiah-2026.top at a glance, and one wrong click can cost someone their savings. We wanted a tool that checks a link before you click it and, just as important, tells you why and what to do next.

What it does

Paste a suspicious message or link into SiagaChat. It:

• finds every link in the text (with or without http://, including IP addresses),
• gives each link a risk score from 0 to 100 and a label: Safe, Caution or Danger,
• explains the verdict in plain words, for example "the domain ending .top is often used for cheap scam sites",
• suggests safe next steps (do not click, never share OTP or PIN, contact the bank through an official channel, how to report in Indonesia),
• works in English and Bahasa Indonesia, including the explanations.

SiagaChat never opens, downloads or contacts the links it checks. It only analyses the text of the URL.

How we built it

SiagaChat is a hybrid of machine learning and transparent rules.

• ML model: a Random Forest (compared with Logistic Regression) trained on 17 host-level features such as domain length, subdomains, hyphens, digits, name randomness, IP hosts, URL shorteners and cheap TLDs. Data: the Kaggle Malicious URLs dataset plus the top 50,000 Tranco domains as benign examples.
• Honest evaluation: we split train and test sets by registered domain, so the same website never appears on both sides.
• Rule layer: a local knowledge layer for Indonesian brands, official domains, .go.id and .mil.id, popular domains and their subdomains, URL shorteners and IP hosts adjusts the model score.
• Explainable reasons: reasons are stored as language-neutral codes and rendered in English or Indonesian, so switching language does not re-run the model.
• App: a Streamlit interface with a language switch and action advice for each label.

Tools: Python, scikit-learn, pandas, tldextract, RapidFuzz and Streamlit.

Challenges we ran into

• The model alone is weak. On held-out domains the Random Forest reaches F1 0.395 (precision 0.35, recall 0.45). Because 79% of the test set is benign, always answering "benign" would score higher accuracy than our model. We decided to report this openly instead of hiding it.
• False alarms. Early on, a legitimate site like docs.python.org was flagged as dangerous, because our benign training examples were bare domains and the model learned to distrust subdomains. We added a rule that trusts popular domains and their own subdomains, but not shared hosting such as *.blogspot.com.
• Finding links in messy text. Our first link finder missed domains like .ai. We replaced a short TLD list with real top-level domain validation.
• Making explanations bilingual meant restructuring how reasons are produced, without changing any score.
• Time. We had a short build window, so we cut features that we could not test properly.

Accomplishments that we're proud of

• A working end-to-end app: paste text, get scores, reasons and advice, in two languages.
• An honest evaluation: a split by domain with no leakage, and results reported as they are, including the weak ones.
• Transparent verdicts: every result comes with reasons a normal person can read.
• Safe by design: no link is ever opened.

What we learned

• Accuracy can be misleading. A model can look decent and still lose to "always say benign" on imbalanced data, so precision, recall and a baseline matter.
• Splitting by domain gives a much more honest picture than a random split.
• Pure ML on public data does not know local brands. Combining it with simple, readable rules makes the system more useful and easier to explain.
• Small user-facing details matter: language, wording and clear next steps.

What's next for SiagaChat: Scam Link Checker

• Analyse the message text too (urgency, requests for OTP or PIN, fake relatives), not just links.
• Build a small hand-labelled set of Indonesian scam and official links to measure the rule layer properly.
• Add path-level features and more Indonesian training data, and add benign examples with subdomains to fix the model's bias.
• Add plain-language explanations written by an LLM that can never change the score.
• Offer it as a chat bot so people can forward suspicious messages directly.

Built With

• joblib
• numpy
• pandas
• python
• rapidfuzz
• scikit-learn
• streamlit
• tldextract