Advanced Smart Analysis‑Driven Browser Security — v1.0.8.5

🛡️ Echtzeit-Webschutz

Every visited URL is automatically scanned using reputation, heuristics, SSL analysis, redirect chains, and script behaviour. Blocks malicious pages instantly via static rule sets and dynamic declarativeNetRequest rules.

🧠 Erweiterte Heuristiken

Erkennt Typosquatting, Homoglyphen-Angriffe, DGA-Domains, gefälschte Anmeldeseiten, geklonte Websites und neue Phishing-Kampagnen mithilfe eines gewichteten Bewertungssystems (0–100).

🪤 Massive tracker blocking

Blocks trackers and ads from 30,000+ domains using 36 filter lists (EasyPrivacy, NoCoin, AdGuard, Peter Lowe's, BlocklistProject, 1Hosts, and more). Per‑domain statistics tracked in real time.

💳 Brand Impersonation Shield

Detects look‑alike domains and cloned login pages impersonating 200+ major brands, and protects 80 legitimate financial domains (Stripe, PayPal, banks, crypto exchanges) from being misflagged when you enter payment details.

⚡ Manifest-V3-Architektur

Fully compliant with Chrome's latest security model: service worker, declarative net request (static + dynamic rules), isolated storage, and download interception.

📊 Per‑domain tracker statistics

See exactly which tracker domains are blocked most often — sorted and ranked in the Activity tab. Filter by tracker type, view top 20 domains with live counts.

🧬 Typosquatting und Homoglyphen-Angriffe

Erkennt Domains, die Marken durch Zeichenaustausch, ähnlich aussehende kyrillische Zeichen und phonetische Tricks imitieren: paypa1.com, g00gle.com. paypa1.com, g00gle.com.

📛 Verdächtige TLDs und DGA

Monitors 14 high‑risk TLDs (.tk, .ml, .ga, .cf, .gq, .xyz, .top, .buzz, .club, .work, .click, .download, .zip, .mov) and uses entropy, consonant/vowel ratio and bigram analysis to detect algorithmically generated domains (DGA).

🔗 Analyse von Weiterleitungen und Kurz-URLs

Resolves shortened links (bit.ly, tinyurl, etc.) and follows redirect chains to block cloaked malicious destinations. Uses SSRF protection on the server proxy.

🪤 Massive tracker blocking

Blocks trackers, ads, and analytics from 30,000+ domains using 36 filter lists: EasyPrivacy, NoCoin, Peter Lowe's, Fanboy Anti‑tracking, AdGuard (Base, Spyware, URL Tracking, Annoyances), BlocklistProject (Ads, Tracking, Malware, Phishing), 1Hosts, EasyList Cookie, and more. All blocking uses Chrome's declarativeNetRequest — both static rules and dynamic rules updated on every service worker restart.

💳 Brand Impersonation Shield

Recognises 80 legitimate financial domains — Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks and crypto exchanges — so real checkouts are never interrupted, while impostor pages, look‑alike domains and cloned logins of 200+ major brands are flagged.

📅 Erweiterte SSL-Reputation

Flags self‑signed, expired or expiring soon (<30 days) and abusable wildcard certificates often used by phishing sites. Weighted scoring from crt.sh certificate transparency data.

🤖 Gewichtete Risikobewertung

Kombiniert mehr als 8 Quellen (Google Safe Browsing, URLScan, AbuseIPDB, PhishDestroy, externe Feeds, PhishStats, DNS-Reputation, SSL-Analyse und lokale Heuristiken) mit dynamischer Gewichtung. Bewertung von 0 bis 100 mit anpassbaren Schwellenwerten.

📦 Verschleierte Skripte und Krypto-Miner

Detects eval/atob, document.write injections, and cryptocurrency miners (CoinHive, Crypto‑Loot) in real time. Part of the 36 tracker lists include NoCoin specifically targeting cryptomining scripts.

🎣 Skimmer & keylogger blocking

Identifies malicious web skimmers and keyloggers injected into checkout and login pages, intercepting card data before it is captured by attackers.

🔑 Credential leak detection

Warns you before credentials leave the page to a suspicious destination, catching credential‑harvesting forms and cross‑site exfiltration attempts.

⚙️ Web Worker monitoring

Monitors for suspicious Web Workers that run silently in the background, a common technique used by crypto miners and skimmers.

🤖 On‑Device Content Analysis

Runs local content analysis fully inside your browser with zero external API calls — page text and structure are scored locally for phishing patterns.

🔦 Search result safety ratings

Shows a safe / suspicious / dangerous badge directly on search engine results so you can avoid risky links before clicking.

📡 Threat Radar

A live radar view of threats detected and blocked across your browsing session, giving an at‑a‑glance picture of your active protection.

🗂️ Multi‑source intelligence

Aggregates cross‑checked signals from phishing databases, domain intelligence feeds and reputation APIs into one weighted verdict.

🤝 Community threat reporting

Report confirmed threats to help protect the wider AIScamHunter community while your report stays fully anonymised.

📴 Local‑only offline detection

Run protection in a fully offline, zero‑API mode — only local heuristics and cache are used, ideal for maximum privacy.

⛔ Schutz vor gefährlichen Downloads

Blockiert ausführbare Dateien (.exe, .bat, .scr, .apk, .js, .msi), analysiert Downloads und bietet die Möglichkeit, verdächtige Dateien zu löschen.

🧾 Gefälschte Anmeldeseiten und Fake-Shops

Identifies cloned banking pages and fake stores via cross‑domain credential submissions, unrealistic discounts, and missing contact or legal notices.

📞 Tech-Support-Betrug und Quishing

Blockiert Browser-Sperrbildschirme, gefälschte Microsoft-/Apple-Warnungen und QR-Code-Phishing-Kampagnen (Quishing).

🖱️ Warnungen beim Überfahren und Kontextmenü

Bewegen Sie den Mauszeiger über einen Link: Bei Gefahr wird eine Warnung angezeigt. Rechtsklick → Link prüfen, Domain blockieren oder sofort vertrauen.

🌍 Safe mode & Strict Private Mode

Increases detection sensitivity, forces HTTPS, blocks legacy plugins. Strict Private Mode forces DoH, blocks WebRTC leaks, auto‑cleans private tabs. Total Privacy Mode blocks third‑party cookies and disables Web Workers.

📋 Erkennung von Zwischenablagen-Manipulationen

Periodic check (every 8s, only when tab is visible) detects replaced crypto addresses or unexpected clipboard changes. Respects browser permissions policy – no errors on restricted sites.

🗑️ Delete History

From the Private page (private.html), users can delete all scan history, stats, and activity events in one action. Resets counters, clears all stored events and daily aggregates. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker statistics

Every blocked tracker request logs the originating domain. The Activity tab's tracker filter shows a ranked table of top domains with live block counts — sorted by most blocked. Stats update every 2 minutes via Chrome's declarativeNetRequest feedback API.

📊 Dynamische Risikobewertung

Jede Seite erhält eine Risikobewertung von 0 bis 100 auf Basis mehrerer Bedrohungsquellen. Die Schwellenwerte können angepasst werden (Strenger Modus, Sicherheitsmodus).

🚨 Sichere Warnseite

Wird eine kritische Bedrohung erkannt, zeigt eine detaillierte Warnseite Kategorie, Schweregrad, erkannte Signale und mögliche Aktionen an (einmal fortfahren, Domain vertrauen, Fehlalarm melden).

🔔 Intelligente Benachrichtigungen

Sofortige Benachrichtigungen, wenn eine schädliche Website blockiert, ein Crypto-Drainer erkannt oder eine verdächtige Weiterleitung festgestellt wird. Deaktivierbar.

🪤 Massive tracker blocker

Blocks trackers, ads, and analytics from 30,000+ domains using 36 filter lists (EasyPrivacy, NoCoin, AdGuard, Peter Lowe's, BlocklistProject, 1Hosts, Fanboy, EasyList Cookie, and 27 more). Uses Chrome's declarativeNetRequest for efficient, native blocking. Per‑domain statistics tracked in the Activity tab.

💳 Brand Impersonation Shield

Protects 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, banks, crypto exchanges) so real checkouts never break, while look‑alike domains and cloned logins of 200+ major brands are scanned and blocked by the normal protection rules.

📊 Tools Center mit Stapel-Scanner

Complete toolkit: URL/domain scanner (batch up to 10), email risk checker, phone number validator, password vault, privacy cleaner, personal stats, persistent history of last 5 checks, sparklines and activity charts.

🔐 Kryptografischer Passwortgenerator

Verwendet crypto.getRandomValues() um starke Passwörter (8–64 Zeichen) mit Großbuchstaben, Zahlen, Symbolen und einer Echtzeit-Stärkeanzeige zu erzeugen.

🧹 Datenschutzreiniger und Datenvernichter

Entfernt Browser-Spuren mit einem Klick, inklusive detaillierter Datenauswahl und Zeitbereichsvorgaben. Bereinigt außerdem IndexedDB und WebSQL.

🗑️ Delete History

From the Private page, delete all scan history, stats, and activity events in one action. Resets all counters and clears stored data. Confirmation dialog prevents accidental deletion.

🌐 Local allow/block lists

Users can manually add domains to personal allowlist or blocklist. They override global rules and persist locally across browser sessions — no account or sync service required.

⚙️ Detaillierte Einstellungen

Enable/disable real‑time shield, safe mode, tracker blocking, download guard, notifications, strict mode, telemetry, strict private mode, total privacy mode. Reset statistics, clear activity log.

🌍 18 languages + RTL

Vollständige Internationalisierung einschließlich Arabisch (Rechts-nach-Links). Das helle/dunkle Design wird mit den Systemeinstellungen synchronisiert.

🔗 Admin-Synchronisierung und Meldung von Fehlalarmen

Benutzer können Fehlalarme direkt von der Warnseite melden. Administratoren prüfen die Meldungen und aktualisieren globale Vertrauens- und Sperrlisten. Die Erweiterung aktualisiert diese Listen stündlich.

🪤 Activity tab tracker filter

The Activity tab includes a dedicated tracker filter (🪤) that shows per‑domain block statistics — top 20 domains sorted by most blocked, with live counts from Chrome's declarativeNetRequest feedback API.

🧪 E-Mail- und Telefonbetrugsprüfung

Prüft E-Mail-Adressen auf Wegwerf- oder schlechte Reputation (Disify API) sowie Telefonnummern gegen bekannte Betrugspräfixe. Verfügbar im Tools Center.

🌐 URL-/Domain-Scanner (Stapelverarbeitung)

Check any URL or domain with multi‑source analysis (Google Safe Browsing, URLScan, PhishDestroy, local heuristics). Returns risk score, category, detected signals. Supports batch scanning of up to 10 URLs at once. Persistent history of last 5 checks with sparklines.

📧 Email risk checker

Detects disposable or low‑reputation email addresses via Disify API (HTTPS). Checks if email is valid, disposable, or has low reputation score. Batch mode available.

📞 Phone number validator

Verifies phone numbers against a curated list of known scam prefixes and flags likely scam numbers. Country selection included.

📊 Aktivitätsdiagramme und Sparklines

Visualises scans, blocked threats, and tracker blocks over 24h, 7 days, and 30 days. Sparkline graphs on stat cards show weekly trends. Dedicated tracker stat card shows total trackers blocked.

🔐 Passwort-Tresor (sicherer Generator)

Erzeugt kryptografisch sichere Passwörter (crypto.getRandomValues). Adjustable length (8‑64 chars), character sets, and a live strength meter (weak → very strong).

🧹 Datenschutzreiniger und Datenvernichter

Entfernt Browser-Spuren mit einem Klick, inklusive detaillierter Datenauswahl und Zeitbereichsvorgaben. Bereinigt außerdem IndexedDB und WebSQL.

🗑️ Delete History

From the Private page, permanently delete all scan history, stats, activity events, and daily aggregates. Resets all counters (pages scanned, threats blocked, warnings, downloads, trackers) to zero. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker stats

Click the tracker stat card in the Activity tab to see a ranked table of top 20 tracker domains by block count. Data comes from Chrome's declarativeNetRequest feedback API — shows real blocked requests, not estimates.

💸 Erkennung von Crypto-Drainers

Überwacht gefährliche Web3-Aufrufe wie approve, transferFrom, personal_sign, eth_signTypedData, wallet_switchEthereumChain and more on pages that inject window.ethereum or window.solana.

🎁 Gefälschte Giveaways / Airdrops

Analysiert Texte und Countdown-Timer, um Betrugsmaschen wie „Elon Musk Giveaway“, „Verdopple deine Kryptowährungen“ und gefälschte Airdrops zu erkennen.

👛 Gefälschte Wallet-Seiten

Erkennt Phishing-Websites, die sich als MetaMask, Binance, Coinbase, Ledger, Trust Wallet, Phantom usw. ausgeben, indem Typosquatting und irreführende Subdomains erkannt werden.

📋 Manipulation der Zwischenablage (Krypto)

Erkennt, wenn eine kopierte Krypto-Adresse (z. B. eine Ethereum-Adresse beginnend mit 0x...) unbemerkt durch eine bösartige Adresse ersetzt wird. Löst eine kritische Warnung aus.

📢 User false‑positive reporting

From the warning page or popup, users can report a blocked domain as a false positive. The report includes domain, timestamp, and anonymised user hash.

🔧 Admin actions

Trust → adds to global allowlist; Block → adds to global blocklist; Resolve → removes the report without global changes. Decisions sync to all users via shared JSON files.

🔄 Hourly synchronisation

The extension polls the server every hour for updated trusted/blocked lists. Admin changes propagate to all users within ≤60 minutes.

📊 Anonymous telemetry (optional)

Anonymous event statistics (event type, category, severity, hashed user id, country) plus the domain of flagged events are sent to improve detection for the whole community. No email, no name and no full browsing URLs are stored. Telemetry is enabled by default and can be disabled with one toggle in settings.

👥 User counting

Total installations are counted via the register telemetry event, which fires only once per genuine first install (stored in chrome.storage.local). Reinstalls after storage clear also register. The service worker restart on idle does not re-trigger registration — the _hasRegistered flag survives restarts.

🪤 Tracker statistics dashboard

The admin dashboard shows real‑time tracker block counts, per‑domain statistics from the dynamic rule matching, and threat activity trends. Updates hourly via telemetry data.

🔒 Local processing

Heuristics (typosquatting, DGA, form analysis, script scanning) run entirely on your device. Only optional safe browsing checks go through secured proxies.

💳 Brand Impersonation Shield

Applied locally in the detection engine — 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay) are never misflagged, so payment data stays on your device and real checkouts are never interrupted. Clones of 200+ major brands are detected locally.

🕶️ Incognito mode support

Extension can be enabled in incognito (manual activation). Private‑browsing activity is kept in an isolated incognito profile and wiped automatically once all private windows close.

📊 Optional anonymised telemetry

A toggle in settings controls event statistics (event type, category, severity, hashed user id, country) and flagged‑domain data sent to improve global detection. No email, name or full URLs are stored. Registration fires once per genuine install.

🛡️ Proxied external APIs

Calls to Google Safe Browsing, URLScan, AbuseIPDB and VirusTotal are routed through AIScamHunter servers to hide your IP and avoid exposing API keys. SSRF protection on all server proxies.

🗑️ Delete History

Permanently delete all local scan history, stats, and activity events from the Private page. Confirmation dialog prevents accidental deletion. No server‑side data is affected.

⚙️ Manifest V3 core

• Service worker (background.js)
• Declarative Net Request: 3 static rule sets (threats, trackers, safe mode) + dynamic rules for tracker blocking
• Isolated storage, alarms, notifications
• Session & local caching

🌐 Threat intelligence sources

• Google Safe Browsing (via proxy)
• URLhaus, OpenPhish, Phishing Army
• PhishStats, PhishDestroy
• URLScan, VirusTotal, AbuseIPDB (via proxy)
• DNS reputation (Google DoH), DNSBL
• Certificate transparency (crt.sh)
• Local heuristics (typosquatting, DGA, homoglyphs)

📂 Internal rule sets

• Malware & phishing (financial, crypto, gov, shipping)
• Tracker blocking — 36 filter lists, 30,000+ domains (static + dynamic DNR rules)
• Safe mode: HTTPS upgrade, block legacy plugins
• Download guard: executable extensions
• Brand impersonation: look‑alike domains and cloned logins for 200+ major brands; 80 legitimate financial domains protected from misflagging

📈 Weighted scoring engine

• Relative weights: Google Safe Browsing 0.25, typosquatting 0.16, URL intelligence 0.14, local heuristics 0.12, PhishDestroy 0.10, URLScan 0.09, VirusTotal 0.10, AbuseIPDB 0.08, threat swarm 0.06, favicon similarity 0.06, certificate transparency (crt.sh) 0.05, external feeds 0.10, DNSBL 0.04, PhishStats 0.04, DNS reputation 0.03, SSL analysis 0.03, domain age 0.02, Wayback archive age 0.02.
• Fixed score adjustments and threshold changes for strict/safe mode
• Contextual reduction (no login/banking keywords)
• Session cache (TTL 30 min)

🪤 Dynamic tracker rules

• 36 filter lists parsed on every service worker restart
• Domains converted to DNR dynamic rules in batches of 500
• Max 30,000 domains, rule IDs 900000+
• Per‑domain tracking via Chrome declarativeNetRequest matched‑rule statistics
• Rule→domain mapping stored for live statistics

🏷️ Brand Impersonation Shield

• Detects look‑alike domains and cloned login pages for 200+ major brands
• 80 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks, crypto exchanges) are never misflagged
• Keeps legitimate checkouts working while threats are blocked