ScamShield

• 

• 

• 

• 

Inspiration

Online scams are becoming increasingly convincing. A suspicious link or message can look completely normal at first glance, and simply telling users that something is "probably a scam" doesn't explain why.

We wanted to build something that helps users understand the evidence behind a potential threat instead of blindly relying on an AI-generated answer.

That led to ScamShield and its core idea: Evidence first. AI second.

What it does

ScamShield is a cybersecurity investigation tool for analyzing potentially suspicious online content.

Users can investigate a URL and receive security-focused findings based on observable indicators. Instead of making AI responsible for the entire detection process, ScamShield performs deterministic analysis first and then uses AI as an optional explanation layer.

The goal is to make technical security findings understandable to normal users, so they can make better-informed decisions before clicking, trusting, or sharing suspicious content.

How we built it

ScamShield was built with Next.js, TypeScript, React, and Tailwind CSS.

The security analysis is designed to run before the AI layer. The system performs deterministic checks, collects evidence and security indicators, and builds the investigation result from those signals.

We then added an optional AI explanation layer using Google Gemini. The AI doesn't replace the underlying analysis; it helps translate the technical findings into a clearer explanation.

We also built supporting security features around the investigation workflow, including SSRF-safe URL handling and OCR capabilities for extracting information from screenshots and other image-based evidence.

The overall architecture follows a simple principle:

Analyze → Collect Evidence → Explain → Let the User Decide

Challenges we ran into

One of the biggest challenges was making the security analysis useful without turning the project into an AI guessing game.

It was tempting to send everything directly to an LLM and ask whether a URL was malicious. Instead, we had to think carefully about which signals could be checked deterministically and how those signals should be represented as evidence.

Another challenge was security itself. A tool that analyzes user-provided URLs has to be careful about SSRF and unsafe network behavior. We had to design the analysis flow so that investigating a suspicious URL doesn't create a new security problem.

We also ran into challenges around making technical findings understandable. Security terminology can quickly become overwhelming, so we focused on presenting evidence in a way that users can actually interpret.

Accomplishments that we're proud of

We're proud that ScamShield isn't simply an AI wrapper around a prompt.

The project has a deterministic security analysis layer that provides evidence before the AI explanation is generated. This separation makes the system easier to reason about and gives users something concrete behind the result.

We're also proud of building the project as a complete investigation workflow rather than just a single detection function—from submitting suspicious content to analyzing it, presenting evidence, and explaining the result.

Most importantly, we were able to turn the idea of "Evidence first. AI second." into an actual product architecture.

What we learned

We learned that building a cybersecurity product is very different from simply building a feature that works on normal inputs.

Security boundaries have to be considered throughout the entire system, especially when the application interacts with user-controlled URLs and external content.

We also learned that AI is often more useful when it complements deterministic systems rather than replacing them. A model can make complex findings easier to understand, but the underlying evidence still matters.

Most of all, we learned to treat security analysis as an evidence and reasoning problem rather than simply a classification problem.

What's next for ScamShield

We want to continue improving ScamShield's detection coverage and evidence quality while keeping the system explainable.

Future work could include expanding the range of scam and phishing indicators, improving analysis of messages and screenshots, strengthening evidence correlation, and adding better investigation history and reporting.

We also want to explore how ScamShield can become useful beyond a single URL investigation—for example, helping users investigate a complete piece of suspicious content while keeping the same evidence-first philosophy.

The goal is simple: make cybersecurity analysis easier to understand without hiding the evidence behind the answer.

Built With

• ai
• cybersecurity
• google-gemini
• next.js
• ocr
• phishing-detection
• react
• scam-detection
• security
• ssrf
• tailwind-css
• tesseract.js
• typescript
• url-analysis