Advanced Smart Analysis‑Driven Browser Security — v1.0.8.5

🛡️ Real‑time web protection

Every visited URL is automatically scanned using reputation, heuristics, SSL analysis, redirect chains, and script behaviour. Blocks malicious pages instantly via static rule sets and dynamic declarativeNetRequest rules.

🧠 Advanced heuristics

Detects typosquatting, homoglyph attacks, DGA domains, fake login pages, cloned websites and zero‑hour phishing campaigns with weighted scoring (0‑100).

🪤 Massive tracker blocking

Blocks trackers and ads from 30,000+ domains using 36 filter lists (EasyPrivacy, NoCoin, AdGuard, Peter Lowe's, BlocklistProject, 1Hosts, and more). Per‑domain statistics tracked in real time.

💳 Brand Impersonation Shield

Detects look‑alike domains and cloned login pages impersonating 200+ major brands, and protects 80 legitimate financial domains (Stripe, PayPal, banks, crypto exchanges) from being misflagged when you enter payment details.

⚡ Manifest V3 architecture

Fully compliant with Chrome's latest security model: service worker, declarative net request (static + dynamic rules), isolated storage, and download interception.

📊 Per‑domain tracker statistics

See exactly which tracker domains are blocked most often — sorted and ranked in the Activity tab. Filter by tracker type, view top 20 domains with live counts.

🧬 Typosquatting & homoglyphs

Detects domains that impersonate brands using character substitution, Cyrillic lookalikes, and phonetic tricks: paypa1.com, g00gle.com.

📛 Suspicious TLDs & DGA

Monitors 14 high‑risk TLDs (.tk, .ml, .ga, .cf, .gq, .xyz, .top, .buzz, .club, .work, .click, .download, .zip, .mov) and uses entropy, consonant/vowel ratio and bigram analysis to detect algorithmically generated domains (DGA).

🔗 Redirect & short URL analysis

Resolves shortened links (bit.ly, tinyurl, etc.) and follows redirect chains to block cloaked malicious destinations. Uses SSRF protection on the server proxy.

🪤 Massive tracker blocking

Blocks trackers, ads, and analytics from 30,000+ domains using 36 filter lists: EasyPrivacy, NoCoin, Peter Lowe's, Fanboy Anti‑tracking, AdGuard (Base, Spyware, URL Tracking, Annoyances), BlocklistProject (Ads, Tracking, Malware, Phishing), 1Hosts, EasyList Cookie, and more. All blocking uses Chrome's declarativeNetRequest — both static rules and dynamic rules updated on every service worker restart.

💳 Brand Impersonation Shield

Recognises 80 legitimate financial domains — Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks and crypto exchanges — so real checkouts are never interrupted, while impostor pages, look‑alike domains and cloned logins of 200+ major brands are flagged.

📅 Advanced SSL reputation

Flags self‑signed, expired or expiring soon (<30 days) and abusable wildcard certificates often used by phishing sites. Weighted scoring from crt.sh certificate transparency data.

🤖 Weighted risk scoring

Combines 8+ sources (Google Safe Browsing, URLScan, AbuseIPDB, PhishDestroy, external feeds, PhishStats, DNS reputation, SSL analysis, local heuristics) with dynamic weights. Score 0‑100 with adjustable thresholds.

📦 Obfuscated scripts & miners

Detects eval/atob, document.write injections, and cryptocurrency miners (CoinHive, Crypto‑Loot) in real time. Part of the 36 tracker lists include NoCoin specifically targeting cryptomining scripts.

🎣 Skimmer & keylogger blocking

Identifies malicious web skimmers and keyloggers injected into checkout and login pages, intercepting card data before it is captured by attackers.

🔑 Credential leak detection

Warns you before credentials leave the page to a suspicious destination, catching credential‑harvesting forms and cross‑site exfiltration attempts.

⚙️ Web Worker monitoring

Monitors for suspicious Web Workers that run silently in the background, a common technique used by crypto miners and skimmers.

🤖 On‑Device Content Analysis

Runs local content analysis fully inside your browser with zero external API calls — page text and structure are scored locally for phishing patterns.

🔦 Search result safety ratings

Shows a safe / suspicious / dangerous badge directly on search engine results so you can avoid risky links before clicking.

📡 Threat Radar

A live radar view of threats detected and blocked across your browsing session, giving an at‑a‑glance picture of your active protection.

🗂️ Multi‑source intelligence

Aggregates cross‑checked signals from phishing databases, domain intelligence feeds and reputation APIs into one weighted verdict.

🤝 Community threat reporting

Report confirmed threats to help protect the wider AIScamHunter community while your report stays fully anonymised.

📴 Local‑only offline detection

Run protection in a fully offline, zero‑API mode — only local heuristics and cache are used, ideal for maximum privacy.

⛔ Dangerous download guard

Blocks executable files (.exe, .bat, .scr, .apk, .js, .msi) and analyses downloaded files; provides option to delete suspicious files.

🧾 Fake login & fake shops

Identifies cloned banking pages and fake stores via cross‑domain credential submissions, unrealistic discounts, and missing contact or legal notices.

📞 Tech support scams & quishing

Blocks browser lock screens, fake Microsoft/Apple alerts, and QR‑code phishing (quishing) campaigns.

🖱️ Hover warnings & context menu

Hover over any link: shows a warning if dangerous. Right‑click → scan link, block or trust domain instantly.

🌍 Safe mode & Strict Private Mode

Increases detection sensitivity, forces HTTPS, blocks legacy plugins. Strict Private Mode forces DoH, blocks WebRTC leaks, auto‑cleans private tabs. Total Privacy Mode blocks third‑party cookies and disables Web Workers.

📋 Clipboard hijack detection

Periodic check (every 8s, only when tab is visible) detects replaced crypto addresses or unexpected clipboard changes. Respects browser permissions policy – no errors on restricted sites.

🗑️ Delete History

From the Private page (private.html), users can delete all scan history, stats, and activity events in one action. Resets counters, clears all stored events and daily aggregates. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker statistics

Every blocked tracker request logs the originating domain. The Activity tab's tracker filter shows a ranked table of top domains with live block counts — sorted by most blocked. Stats update every 2 minutes via Chrome's declarativeNetRequest feedback API.

📊 Dynamic risk score

Every page receives a 0‑100 risk score based on multi‑source intelligence. Thresholds can be customised (strict mode, safe mode).

🚨 Secure warning page

When a critical threat is detected, a detailed interceptor shows category, severity, detected signals, and actions (continue once, trust domain, report false positive).

🔔 Smart notifications

Instant alerts when a malicious site is blocked, a crypto drainer is identified, or a suspicious redirect occurs. Disableable.

🪤 Massive tracker blocker

Blocks trackers, ads, and analytics from 30,000+ domains using 36 filter lists (EasyPrivacy, NoCoin, AdGuard, Peter Lowe's, BlocklistProject, 1Hosts, Fanboy, EasyList Cookie, and 27 more). Uses Chrome's declarativeNetRequest for efficient, native blocking. Per‑domain statistics tracked in the Activity tab.

💳 Brand Impersonation Shield

Protects 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, banks, crypto exchanges) so real checkouts never break, while look‑alike domains and cloned logins of 200+ major brands are scanned and blocked by the normal protection rules.

📊 Tools Center with batch scanner

Complete toolkit: URL/domain scanner (batch up to 10), email risk checker, phone number validator, password vault, privacy cleaner, personal stats, persistent history of last 5 checks, sparklines and activity charts.

🔐 Cryptographic password generator

Uses crypto.getRandomValues() to generate strong passwords (8‑64 chars) with uppercase, digits, symbols and a real‑time strength indicator.

🧹 Privacy cleaner & shredder

One‑click removal of browsing traces with granular data type selection and time‑range presets. Also cleans IndexedDB and WebSQL.

🗑️ Delete History

From the Private page, delete all scan history, stats, and activity events in one action. Resets all counters and clears stored data. Confirmation dialog prevents accidental deletion.

🌐 Local allow/block lists

Users can manually add domains to personal allowlist or blocklist. They override global rules and persist locally across browser sessions — no account or sync service required.

⚙️ Fine‑grained settings

Enable/disable real‑time shield, safe mode, tracker blocking, download guard, notifications, strict mode, telemetry, strict private mode, total privacy mode. Reset statistics, clear activity log.

🌍 18 languages + RTL

Full internationalisation including Arabic (right‑to‑left). Light/dark theme syncs with system preference.

🔗 Admin sync & false positive reporting

Users can report false positives from the warning page. Administrators review and update global trusted/blocked lists. Extension refreshes lists hourly.

🪤 Activity tab tracker filter

The Activity tab includes a dedicated tracker filter (🪤) that shows per‑domain block statistics — top 20 domains sorted by most blocked, with live counts from Chrome's declarativeNetRequest feedback API.

🧪 Email & phone scam check

Checks email addresses for disposable/low reputation (Disify API) and phone numbers against known scam prefixes. Available in Tools Center.

🌐 URL / Domain scanner (batch)

Check any URL or domain with multi‑source analysis (Google Safe Browsing, URLScan, PhishDestroy, local heuristics). Returns risk score, category, detected signals. Supports batch scanning of up to 10 URLs at once. Persistent history of last 5 checks with sparklines.

📧 Email risk checker

Detects disposable or low‑reputation email addresses via Disify API (HTTPS). Checks if email is valid, disposable, or has low reputation score. Batch mode available.

📞 Phone number validator

Verifies phone numbers against a curated list of known scam prefixes and flags likely scam numbers. Country selection included.

📊 Activity charts & sparklines

Visualises scans, blocked threats, and tracker blocks over 24h, 7 days, and 30 days. Sparkline graphs on stat cards show weekly trends. Dedicated tracker stat card shows total trackers blocked.

🔐 Password vault (secure generator)

Cryptographically strong passwords (crypto.getRandomValues). Adjustable length (8‑64 chars), character sets, and a live strength meter (weak → very strong).

🧹 Privacy cleaner & shredder

One‑click removal of browsing traces with granular data type selection and time‑range presets. Also cleans IndexedDB and WebSQL.

🗑️ Delete History

From the Private page, permanently delete all scan history, stats, activity events, and daily aggregates. Resets all counters (pages scanned, threats blocked, warnings, downloads, trackers) to zero. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker stats

Click the tracker stat card in the Activity tab to see a ranked table of top 20 tracker domains by block count. Data comes from Chrome's declarativeNetRequest feedback API — shows real blocked requests, not estimates.

💸 Crypto drainer detection

Monitors dangerous Web3 calls: approve, transferFrom, personal_sign, eth_signTypedData, wallet_switchEthereumChain and more on pages that inject window.ethereum or window.solana.

🎁 Fake giveaway / airdrop

Text and countdown timer analysis to detect "Elon Musk giveaway", "double your crypto", and fake airdrop campaigns.

👛 Fake wallet pages

Identifies phishing sites impersonating MetaMask, Binance, Coinbase, Ledger, Trust Wallet, Phantom, etc., using typosquatting and subdomain tricks.

📋 Clipboard hijacking (crypto)

Detects when a copied crypto address (e.g., 0x... Ethereum address) is silently replaced by a malicious address. Triggers a critical alert.

📢 User false‑positive reporting

From the warning page or popup, users can report a blocked domain as a false positive. The report includes domain, timestamp, and anonymised user hash.

🔧 Admin actions

Trust → adds to global allowlist; Block → adds to global blocklist; Resolve → removes the report without global changes. Decisions sync to all users via shared JSON files.

🔄 Hourly synchronisation

The extension polls the server every hour for updated trusted/blocked lists. Admin changes propagate to all users within ≤60 minutes.

📊 Anonymous telemetry (optional)

Anonymous event statistics (event type, category, severity, hashed user id, country) plus the domain of flagged events are sent to improve detection for the whole community. No email, no name and no full browsing URLs are stored. Telemetry is enabled by default and can be disabled with one toggle in settings.

👥 User counting

Total installations are counted via the register telemetry event, which fires only once per genuine first install (stored in chrome.storage.local). Reinstalls after storage clear also register. The service worker restart on idle does not re-trigger registration — the _hasRegistered flag survives restarts.

🪤 Tracker statistics dashboard

The admin dashboard shows real‑time tracker block counts, per‑domain statistics from the dynamic rule matching, and threat activity trends. Updates hourly via telemetry data.

🔒 Local processing

Heuristics (typosquatting, DGA, form analysis, script scanning) run entirely on your device. Only optional safe browsing checks go through secured proxies.

💳 Brand Impersonation Shield

Applied locally in the detection engine — 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay) are never misflagged, so payment data stays on your device and real checkouts are never interrupted. Clones of 200+ major brands are detected locally.

🕶️ Incognito mode support

Extension can be enabled in incognito (manual activation). Private‑browsing activity is kept in an isolated incognito profile and wiped automatically once all private windows close.

📊 Optional anonymised telemetry

A toggle in settings controls event statistics (event type, category, severity, hashed user id, country) and flagged‑domain data sent to improve global detection. No email, name or full URLs are stored. Registration fires once per genuine install.

🛡️ Proxied external APIs

Calls to Google Safe Browsing, URLScan, AbuseIPDB and VirusTotal are routed through AIScamHunter servers to hide your IP and avoid exposing API keys. SSRF protection on all server proxies.

🗑️ Delete History

Permanently delete all local scan history, stats, and activity events from the Private page. Confirmation dialog prevents accidental deletion. No server‑side data is affected.

⚙️ Manifest V3 core

• Service worker (background.js)
• Declarative Net Request: 3 static rule sets (threats, trackers, safe mode) + dynamic rules for tracker blocking
• Isolated storage, alarms, notifications
• Session & local caching

🌐 Threat intelligence sources

• Google Safe Browsing (via proxy)
• URLhaus, OpenPhish, Phishing Army
• PhishStats, PhishDestroy
• URLScan, VirusTotal, AbuseIPDB (via proxy)
• DNS reputation (Google DoH), DNSBL
• Certificate transparency (crt.sh)
• Local heuristics (typosquatting, DGA, homoglyphs)

📂 Internal rule sets

• Malware & phishing (financial, crypto, gov, shipping)
• Tracker blocking — 36 filter lists, 30,000+ domains (static + dynamic DNR rules)
• Safe mode: HTTPS upgrade, block legacy plugins
• Download guard: executable extensions
• Brand impersonation: look‑alike domains and cloned logins for 200+ major brands; 80 legitimate financial domains protected from misflagging

📈 Weighted scoring engine

• Relative weights: Google Safe Browsing 0.25, typosquatting 0.16, URL intelligence 0.14, local heuristics 0.12, PhishDestroy 0.10, URLScan 0.09, VirusTotal 0.10, AbuseIPDB 0.08, threat swarm 0.06, favicon similarity 0.06, certificate transparency (crt.sh) 0.05, external feeds 0.10, DNSBL 0.04, PhishStats 0.04, DNS reputation 0.03, SSL analysis 0.03, domain age 0.02, Wayback archive age 0.02.
• Fixed score adjustments and threshold changes for strict/safe mode
• Contextual reduction (no login/banking keywords)
• Session cache (TTL 30 min)

🪤 Dynamic tracker rules

• 36 filter lists parsed on every service worker restart
• Domains converted to DNR dynamic rules in batches of 500
• Max 30,000 domains, rule IDs 900000+
• Per‑domain tracking via Chrome declarativeNetRequest matched‑rule statistics
• Rule→domain mapping stored for live statistics

🏷️ Brand Impersonation Shield

• Detects look‑alike domains and cloned login pages for 200+ major brands
• 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks, crypto exchanges) are never misflagged
• Keeps legitimate checkouts working while threats are blocked