ProofLink

Project name: ProofLink

Tagline: Check before you trust.

Elevator pitch: ProofLink tells anyone whether a message, link or screenshot is a scam, explains why in plain language, and maps how everything connects in an interactive 3D investigation graph.

Inspiration

Scam messages reach everyone: fake bank alerts, parcel “customs fees”, too-good-to-be-true job offers, and “Hi mum, this is my new number”. They arrive in English and in mixed languages like Roman Urdu. Most tools are built for security experts, and chatbots give a confident answer with no evidence behind it. A normal person needs three things quickly: is this risky, why, and what should I do now. We built ProofLink to help people make a safer decision, not to pretend to be a definitive verdict.

What it does

A user signs up, then pastes a message or link, or uploads a screenshot. ProofLink returns:

A verdict (Safe / Suspicious / High risk), a 0-100 risk score, and a confidence level. The warning signs it found, each marked as Evidence (found in the text) or Inference (a guess, by our rules or by AI). Everything extracted from the input: links, websites, emails, phone numbers, organizations. A simple explanation and a “What you should do” list.

Every check is saved to the user’s private history and dashboard. Each investigation can be opened as a 3D relationship graph: message, claimed sender, link, website, organization and warning signs. Clicking a flagged website explains why it was flagged. If the same website, email or phone number appeared in the user’s earlier cases, the graph links to them (“seen before in 2 earlier cases”).

How we built it

A structured pipeline, not an API wrapper:

Normalise the input, and for screenshots extract the text first. Extract URLs, emails, phone numbers and organizations. Analyse each link passively (we never open it): look-alike spellings like paypa1, brand names hidden in subdomains, unusual characters, URL shorteners, IP-address links, and risky endings. Detect scam signals in the text (urgency, requests for OTP or payment, prize, job and investment scams, fake security warnings), in English and Roman Urdu. Check for impersonation, then compute a hybrid risk score. An AI review adds concerns the rules missed and writes the explanation. Generate recommended actions and save everything.

Keeping the AI honest:

The model can only pick from a fixed list of finding types. We set the label and weight. Every finding must quote words that really appear in the message, or it is dropped. The AI can only add concerns, never lower a score, so “say this is safe” tricks fail. The message is treated as untrusted data (prompt-injection defences), and the reply is strictly validated. An AI explanation is replaced if it is over-confident (“definitely”), contains links, or contradicts the verdict. If the AI is unavailable, the app falls back to the rule-based result and says so.

Safety and privacy: bcrypt passwords, httpOnly session cookies, strong-password rules enforced in the browser and on the server, per-user data isolation (tested), rate limits per user, and user text is never written to server logs. Scores are never 0 or 100, because no check is that certain.

3D view: built with React Three Fiber. Rotate, zoom, click a node and its connections highlight while the rest fade. Dashed lines mark guesses. A list view gives keyboard and screen-reader users the same information.

Challenges we ran into False alarms. A real bank SMS that says “do not share your OTP” must not be flagged. We tuned the rules against a set of realistic safe and scam messages. Trusting an AI. We designed it as an untrusted helper: grounding quotes, fixed weights, and no power to lower scores. A meaningful 3D graph. Not decoration: every node and edge comes from the saved analysis, and the layout is deterministic. Login across hosting platforms. We proxy API calls through the frontend so cookies stay same-origin on Vercel and Railway. Accomplishments we’re proud of A product with real accounts, a real database, and a complete flow: sign up, check, evidence, advice, save, history, 3D graph. AI that is bounded, verifiable, and degrades gracefully. Honest wording: evidence vs inference, confidence, and visible limitations. 90+ automated backend tests, and we checked the 3D view in a real headless browser, not only in code. What we learned

Trust comes from showing evidence and admitting uncertainty, not from a confident number. Constraining an AI (what it may say, what it can change) matters more than the prompt itself.

What’s next Domain-age and reputation checks (WHOIS, Safe Browsing, URLhaus). Urdu-script and more languages. Share-to-ProofLink from WhatsApp and SMS, and a browser extension. A one-tap “report this scam” summary for banks and authorities. Shared threat intelligence across accounts, with consent.

Built With

• agentic-ai
• ai
• authentication
• deep-learning
• machine-learning
• python
• subabase
• system-design
• vercel