Inspiration

Every single day, millions of people worldwide receive deceptive text messages, fraudulent WhatsApp forwards, spoofed bank alerts, and malicious job offers. For cybersecurity veterans, spotting a phishing link might feel routine—but for elderly parents, teenagers, and everyday consumers, a single convincing message claiming: "Your bank account has been locked due to irregular activity. Verify immediately at bit.ly/3xSecAlert to avoid permanent suspension." can lead to life-altering financial devastation, drained savings, and compromised digital identities. Traditional spam filters rely heavily on static blocklists and naive keyword regex rules. However, modern cybercriminals leverage generative AI to dynamically rephrase social engineering lures, spin up disposable lookalike domains, and evade signature-based defenses. We were inspired by a fundamental imperative: "What if anyone could pause, check any suspicious message or URL, and receive an instant, mathematically grounded, explainable security verdict that unmasks the deceptive psychology behind the attack?" From this mission, ScamShield AI was born—anchored by the core human defense philosophy: Pause. Check. Protect.

What it does

ScamShield AI is an intelligent, real-time phishing and scam detection sentinel designed for everyday users and developers. Rather than outputting an opaque binary judgment, ScamShield AI provides transparent, interpretable telemetry: Explainable Risk Scoring: Evaluates structural, linguistic, and domain anomalies to compute a transparent risk index . Deceptive Psychological Marker Deconstruction: Identifies artificial urgency triggers, authority impersonation, fear-inducing threats, and credential harvesting traps. Domain Homoglyph & Entropy Inspection: Flags algorithmically generated domains, punycode lookalikes (e.g., Cyrillic а masquerading as Latin a), and multi-hop URL redirection chains. Zero-Trust Privacy Protocol: Uses client-side tokenization so sensitive numbers, names, and OTPs are redacted prior to analysis. Security Thumbnail & Brand Studio: An integrated, high-DPI canvas studio that generates production-grade GitHub repository thumbnails, social preview cards (1280×640 / 16:9), and README badges for open-source repositories

How we built it

ScamShield AI and its accompanying Security Thumbnail Studio were built with an end-to-end, high-reliability stack combining AI reasoning, mathematical risk modeling, and a high-DPI visual engine:

1. Mathematical Threat Formulation & Bayesian Risk Engine Scam probability is computed using a multi-factor Bayesian ensemble combining lexical pressure features, semantic embeddings, and structural domain signals. The composite threat score is formalized as: Where: quantifies artificial temporal pressure (e.g., "urgent", "within 24 hours", "account suspended"). captures algorithmic randomness in spoofed subdomains and homoglyph URLs. measures cosine similarity against vector embeddings of known threat clusters: represents verified institutional sender reputation. squashes the logit into a normalized confidence interval . For operational classification thresholds: \text{Verdict}(x) = \begin{cases} \mathbf{MALICIOUS} & \text{if } \mathcal{S} \ge \tau_{\text{high}} \quad (\tau_{\text{high}} = 0.85) \ \mathbf{SUSPICIOUS} & \text{if } \tau_{\text{low}} \le \mathcal{S} < \tau_{\text{high}} \quad (\tau_{\text{low}} = 0.50) \ \mathbf{SAFE} & \text{if } \mathcal{S} < \tau_{\text{low}} \end{cases}
2. Frontend & High-DPI Visual Engine React 19 & Tailwind CSS v4: Built with an obsidian navy (#0A0F1D), cryptographic emerald (#10B981), and cyan (#06B6D4) palette. HTML5 Canvas Subsystem: High-DPI rasterizer supporting responsive aspect ratios (16:9, 1280×640 GitHub OpenGraph, 1:1 Avatar, 8:3 README Header), procedural cyber grid lines, and DPR rendering. Gemini 3.8 Flash Integration: Powers natural language prompt refinement, translating user descriptions into cinematic 3D cyber specifications. Challenges we ran into The Asymmetric Cost of False Positives: In cybersecurity, a false positive (flagging a genuine bank OTP or emergency password reset as a scam) shatters user trust. We addressed this with an asymmetric cost matrix loss:

This calibrated the decision boundary to demand overwhelming corroborating evidence before issuing a blocking alert. Homoglyph and Punycode Camouflage: Attackers frequently substitute Cyrillic characters (e.g., а instead of Latin a) to mimic legitimate domains like paypal.com. We engineered a deterministic Unicode normalization layer that decomposes and projects incoming strings into canonical NFKD form prior to entropy evaluation. Multi-Platform Aspect Ratio Distortion: Designing repository thumbnails that look equally crisp in GitHub repository settings, Discord bot embeds, and Twitter OpenGraph cards required developing an adaptive bounding-box layout that keeps the core shield emblem within the safe viewing ellipse.

Accomplishments that we're proud of

Explainable Threat Reasoning: Successfully delivering sub-second breakdown of why a message is hazardous, educating users in security literacy rather than leaving them in the dark. Institutional-Grade Visual Identity: Building a cohesive, security-focused aesthetic featuring 3D frosted crystal shields, cryptographic locks, and calibrated trust badges. Client-Side Canvas Engine: Real-time in-browser rendering and 1080p PNG/JPG export without external server dependencies. High-Fidelity AI Prompt Engineering: Seamlessly integrating Gemini 3.8 Flash to transform basic text inputs into rich, photorealistic cybersecurity visual prompts.

What we learned

Explainability Beats Pure Accuracy: Users don't just want a percentage; they need to know why a message is risky. Highlighting specific trigger cues empowers users with lifelong threat literacy. Visual Design is a Security Feature: Trust-first aesthetics and clean typography dramatically boost user adherence to security warnings. Structured AI Outputs: Schema-constrained prompt reasoning produces robust, production-ready markdown snippets and badge configurations.

What's next for ScamShield AI — Pause. Check. Protect.

On-Device WebAssembly / Edge Inference: Real-time message triage directly on mobile devices and browser runtimes without server roundtrips. Autonomous Honeypot Agents: Safely engaging scam actors to extract wallet addresses and malicious infrastructure for global blocklists. Browser Extension: Inline ambient protection for webmail, WhatsApp Web, and messaging platforms with real-time URL sandboxing. Decentralized Threat Telemetry: Zero-knowledge reporting of emerging scam campaigns to community-driven fraud defense registries. Repository: github.com/janu200512/scamshield-ai

Built With

• ai-safety
• anti-fraud
• bayesian-modeling
• cybersecurity
• express.js
• gemini-3.8-flash
• gemini-api
• html5
• information-security
• lucide-react
• motion
• natural-language-processing
• node.js
• open-graph
• phishing-detection
• prompt-engineering
• react
• react-19
• scam-prevention
• tailwind-css
• threat-intelligence
• typescript
• vite
• zero-trust