Advanced Smart Analysis‑Driven Browser Security — v1.2.0

🛡️ Protection web en temps réel

Every visited URL is automatically scanned using reputation, heuristics, SSL analysis, redirect chains, and script behaviour. Blocks malicious pages instantly via static rule sets and dynamic declarativeNetRequest rules.

🧠 Heuristiques avancées

Détecte le typosquatting, les attaques par homoglyphes, les domaines DGA, les fausses pages de connexion, les sites clonés et les campagnes de phishing émergentes grâce à un système de notation pondéré (0 à 100).

🪤 Massive tracker blocking

Blocks trackers and ads from 454,000+ domains across 9 tracker categories (ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads, fingerprinters), backed by a 462,941‑domain intelligence database. Per‑domain statistics tracked in real time.

💳 Brand Impersonation Shield

Detects look‑alike domains, cloned login pages and fake icons impersonating 300 major brands, and protects 81 legitimate financial domains (Stripe, PayPal, banks, crypto exchanges) from being misflagged when you enter payment details.

🖥️ Fake instruction‑overlay blocking

Catches the fake "press Win+R and paste this" overlays used by modern tech‑support and malware attacks, flags malicious shell commands hidden inside page content, and detects invisible instructions trying to hijack AI assistants.

🧩 Malicious extension alerts

Checks your installed browser extensions on‑device and warns you when a known malicious or unwanted extension is found. The extension list never leaves your device.

⚡ Architecture Manifest V3

Fully compliant with Chrome's latest security model: service worker, declarative net request (static + dynamic rules), isolated storage, and download interception.

📊 Per‑domain tracker statistics

See exactly which tracker domains are blocked most often — sorted and ranked in the Activity tab. Filter by tracker type, view top 20 domains with live counts.

🧬 Typosquatting et attaques par homoglyphes

Détecte les domaines qui imitent des marques à l’aide de substitutions de caractères, de lettres cyrilliques ressemblantes et de techniques phonétiques : paypa1.com, g00gle.com. paypa1.com, g00gle.com.

📛 TLD suspects et DGA

Monitors 43 high‑risk TLDs (.tk, .ml, .ga, .cf, .gq, .xyz, .top, .click and more) and uses entropy, consonant/vowel ratio and bigram analysis to detect algorithmically generated domains (DGA).

🔗 Analyse des redirections et des URL raccourcies

Resolves shortened links (bit.ly, tinyurl, etc.) and follows redirect chains to block cloaked malicious destinations. Uses SSRF protection on the server proxy.

🪤 Massive tracker blocking

Blocks trackers, ads, and analytics from 454,000+ domains across 9 tracker categories — ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads and fingerprinters — drawn from a 462,941‑domain intelligence database. All blocking uses Chrome's declarativeNetRequest: static rule sets ship with the extension, and dynamic rules refresh from our servers on every service worker restart (34 external lists — EasyPrivacy, NoCoin, AdGuard and more — serve as offline fallback).

💳 Brand Impersonation Shield

Recognises 81 legitimate financial domains — Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks and crypto exchanges — so real checkouts are never interrupted, while impostor pages, look‑alike domains, cloned logins and fake favicons of 300 major brands are flagged (990 known icon fingerprints compared on every scan).

📅 Réputation SSL avancée

Flags brand‑new, self‑signed, expired or expiring soon (<30 days) and abusable wildcard certificates often used by phishing sites, weighted with certificate‑age tracking remembered between visits. Weighted scoring from crt.sh certificate transparency data.

🤖 Évaluation du risque pondérée

Combine plus de 8 sources (Google Safe Browsing, URLScan, AbuseIPDB, PhishDestroy, flux externes, PhishStats, réputation DNS, analyse SSL et heuristiques locales) avec des pondérations dynamiques. Score de 0 à 100 avec seuils ajustables.

📦 Verschleierte scripts et mineurs crypto

Detects eval/atob, document.write injections, and cryptocurrency miners (CoinHive, Crypto‑Loot) in real time. The cryptominer tracker category specifically targets mining scripts.

🎣 Skimmer & keylogger blocking

Identifies malicious web skimmers and keyloggers injected into checkout and login pages, intercepting card data before it is captured by attackers.

🔑 Credential leak detection

Warns you before credentials leave the page to a suspicious destination, catching credential‑harvesting forms and cross‑site exfiltration attempts.

⚙️ Web Worker monitoring

Monitors for suspicious Web Workers that run silently in the background, a common technique used by crypto miners and skimmers.

🤖 On‑Device Content Analysis

Runs local content analysis fully inside your browser with zero external API calls — page text and structure are scored locally for phishing patterns.

🔦 Search result safety ratings

Shows a safe / suspicious / dangerous badge directly on search engine results so you can avoid risky links before clicking.

📡 Threat Radar

A live radar view of threats detected and blocked across your browsing session, giving an at‑a‑glance picture of your active protection.

🗂️ Multi‑source intelligence

Aggregates cross‑checked signals from phishing databases, domain intelligence feeds and reputation APIs into one weighted verdict.

🤝 Community threat reporting

Report confirmed threats to help protect the wider AIScamHunter community while your report stays fully anonymised.

📴 Local‑only offline detection

Run protection in a fully offline, zero‑API mode — only local heuristics and cache are used, ideal for maximum privacy.

⛔ Protection contre les téléchargements dangereux

Blocks 55 risky file types (.exe, .msi, .bat, .scr, .apk, .iso, .lnk, macro documents such as .docm/.xlsm and more), catches disguised files (double extensions, homoglyph tricks, bait‑and‑switch URLs), pauses risky downloads from fresh or unknown sources, and can delete suspicious files.

🧾 Faux formulaires de connexion et fausses boutiques

Identifies cloned banking pages and fake stores via cross‑domain credential submissions, unrealistic discounts, and missing contact or legal notices.

📞 Arnaques au faux support technique et quishing

Bloque les écrans de verrouillage du navigateur, les fausses alertes Microsoft/Apple et les campagnes de phishing par QR code (quishing).

🖱️ Alertes au survol et menu contextuel

Survolez un lien : un avertissement s’affiche s’il est dangereux. Clic droit → analyser le lien, bloquer ou approuver le domaine instantanément.

🌍 Safe mode & Strict Private Mode

Increases detection sensitivity, forces HTTPS, blocks legacy plugins. Strict Private Mode forces DoH, blocks WebRTC leaks, auto‑cleans private tabs. Total Privacy Mode blocks third‑party cookies and disables Web Workers.

📋 Détection du détournement du presse-papiers

Periodic check (every 8s, only when tab is visible) detects replaced crypto addresses or unexpected clipboard changes. Respects browser permissions policy – no errors on restricted sites.

🗑️ Delete History

From the Private page (private.html), users can delete all scan history, stats, and activity events in one action. Resets counters, clears all stored events and daily aggregates. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker statistics

Every blocked tracker request logs the originating domain. The Activity tab's tracker filter shows a ranked table of top domains with live block counts — sorted by most blocked. Stats update every 2 minutes via Chrome's declarativeNetRequest feedback API.

📊 Score de risque dynamique

Chaque page reçoit un score de risque de 0 à 100 basé sur des données provenant de multiples sources. Les seuils peuvent être personnalisés (mode strict, mode sécurisé).

🚨 Page d’avertissement sécurisée

Lorsqu’une menace critique est détectée, une page d’interception détaillée affiche la catégorie, le niveau de gravité, les signaux détectés et les actions possibles (continuer une fois, approuver le domaine, signaler un faux positif).

🔔 Notifications intelligentes

Alertes instantanées lorsqu’un site malveillant est bloqué, qu’un crypto drainer est détecté ou qu’une redirection suspecte se produit. Désactivables.

🪤 Massive tracker blocker

Blocks trackers, ads, and analytics from 454,000+ domains across 9 tracker categories (ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads, fingerprinters) from a 462,941‑domain database. Uses Chrome's declarativeNetRequest for efficient, native blocking. Per‑domain statistics tracked in the Activity tab.

💳 Brand Impersonation Shield

Protects 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, banks, crypto exchanges) so real checkouts never break, while look‑alike domains, cloned logins and fake icons of 300 major brands are scanned and blocked by the normal protection rules.

📊 Centre d’Outils avec scanner par lots

Complete toolkit: URL/domain scanner (batch up to 10), email risk checker, phone number validator, password vault, privacy cleaner, personal stats, persistent history of last 5 checks, sparklines and activity charts.

🔐 Générateur cryptographique de mots de passe

Utilise crypto.getRandomValues() pour générer des mots de passe robustes (8 à 64 caractères) avec majuscules, chiffres, symboles et indicateur de robustesse en temps réel.

🧹 Nettoyeur et destructeur de données privées

Suppression en un clic des traces de navigation avec sélection détaillée des types de données et plages temporelles prédéfinies. Nettoie également IndexedDB et WebSQL.

🗑️ Delete History

From the Private page, delete all scan history, stats, and activity events in one action. Resets all counters and clears stored data. Confirmation dialog prevents accidental deletion.

🌐 Local allow/block lists

Users can manually add domains to personal allowlist or blocklist. They override global rules and persist locally across browser sessions — no account or sync service required.

⚙️ Paramètres avancés

Enable/disable real‑time shield, safe mode, tracker blocking, download guard, notifications, strict mode, telemetry, strict private mode, total privacy mode. Reset statistics, clear activity log.

🌍 18 languages + RTL

Internationalisation complète incluant l’arabe (écriture de droite à gauche). Le thème clair/sombre se synchronise avec les préférences système.

🔗 Synchronisation administrateur et signalement des faux positifs

Les utilisateurs peuvent signaler les faux positifs depuis la page d’avertissement. Les administrateurs examinent les signalements et mettent à jour les listes globales de confiance ou de blocage. L’extension actualise ces listes toutes les heures.

🪤 Activity tab tracker filter

The Activity tab includes a dedicated tracker filter (🪤) that shows per‑domain block statistics — top 20 domains sorted by most blocked, with live counts from Chrome's declarativeNetRequest feedback API.

🧪 Vérification des arnaques par e-mail et téléphone

Vérifie les adresses e-mail jetables ou à faible réputation (API Disify) ainsi que les numéros de téléphone associés à des préfixes connus pour les arnaques. Disponible dans le Centre d’Outils.

🧠 On‑Device ML classifier

A local machine‑learning model scores every page directly in your browser. Inference and features stay on your device — no page content is ever sent to a server for the model.

💬 Scam‑text detection (16 languages)

Reads page text against a scam‑wording taxonomy covering English, French, Spanish, Arabic, Chinese, German, Italian, Portuguese, Russian, Dutch, Turkish, Korean, Japanese, Indonesian, Vietnamese and Hindi — tech support, romance, smishing, investment, callback, advance‑fee and more. It also flags fake "Win+R" instruction overlays, commands hidden in page content and invisible instructions aimed at hijacking AI assistants.

🗃️ Site Memory (30 days)

Blocked and warned sites are remembered locally for 30 days with per‑domain counts, so repeat offenders are recognised instantly and your protection history stays visible across sessions.

🌐 Analyseur d’URL / Domaines (par lots)

Check any URL or domain with multi‑source analysis (Google Safe Browsing, URLScan, PhishDestroy, local heuristics). Returns risk score, category, detected signals. Supports batch scanning of up to 10 URLs at once. Persistent history of last 5 checks with sparklines.

📧 Email risk checker

Detects disposable or low‑reputation email addresses via Disify API (HTTPS). Checks if email is valid, disposable, or has low reputation score. Batch mode available.

📞 Phone number validator

Verifies phone numbers against a curated list of known scam prefixes and flags likely scam numbers. Country selection included.

📊 Graphiques d’activité et mini-tendances

Visualises scans, blocked threats, and tracker blocks over 24h, 7 days, and 30 days. Sparkline graphs on stat cards show weekly trends. Dedicated tracker stat card shows total trackers blocked.

🔐 Coffre-fort de mots de passe (générateur sécurisé)

Génère des mots de passe cryptographiquement robustes (crypto.getRandomValues). Adjustable length (8‑64 chars), character sets, and a live strength meter (weak → very strong).

🧹 Nettoyeur et destructeur de données privées

Suppression en un clic des traces de navigation avec sélection détaillée des types de données et plages temporelles prédéfinies. Nettoie également IndexedDB et WebSQL.

🗑️ Delete History

From the Private page, permanently delete all scan history, stats, activity events, and daily aggregates. Resets all counters (pages scanned, threats blocked, warnings, downloads, trackers) to zero. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker stats

Click the tracker stat card in the Activity tab to see a ranked table of top 20 tracker domains by block count. Data comes from Chrome's declarativeNetRequest feedback API — shows real blocked requests, not estimates.

💸 Détection des crypto drainers

Surveille les appels Web3 dangereux : approve, transferFrom, personal_sign, eth_signTypedData, wallet_switchEthereumChain and more on pages that inject window.ethereum or window.solana.

🎁 Faux giveaways / airdrops frauduleux

Analyse le contenu textuel et les comptes à rebours afin de détecter les arnaques du type « Elon Musk Giveaway », « doublez vos cryptos » et les faux airdrops.

👛 Fausses pages de portefeuilles crypto

Identifie les sites de phishing usurpant l’identité de MetaMask, Binance, Coinbase, Ledger, Trust Wallet, Phantom, etc., grâce à la détection du typosquatting et des sous-domaines trompeurs.

📋 Détournement du presse-papiers (crypto)

Détecte lorsqu’une adresse crypto copiée (par exemple une adresse Ethereum commençant par 0x...) est discrètement remplacée par une adresse malveillante. Déclenche une alerte critique.

📢 User false‑positive reporting

From the warning page or popup, users can report a blocked domain as a false positive. The report includes domain, timestamp, and anonymised user hash.

🔧 Admin actions

Trust → adds to global allowlist; Block → adds to global blocklist; Resolve → removes the report without global changes. Decisions sync to all users via shared JSON files.

🔄 Hourly synchronisation

The extension polls the server every hour for updated trusted/blocked lists. Admin changes propagate to all users within ≤60 minutes.

📊 Anonymous telemetry (optional)

Anonymous event statistics (event type, category, severity, hashed user id, country) plus the domain of flagged events are sent to improve detection for the whole community. No email, no name and no full browsing URLs are stored. Telemetry is enabled by default and can be disabled with one toggle in settings.

👥 User counting

Total installations are counted via the register telemetry event, which fires only once per genuine first install (stored in chrome.storage.local). Reinstalls after storage clear also register. The service worker restart on idle does not re-trigger registration — the _hasRegistered flag survives restarts.

🪤 Tracker statistics dashboard

The admin dashboard shows real‑time tracker block counts, per‑domain statistics from the dynamic rule matching, and threat activity trends. Updates hourly via telemetry data.

🔒 Local processing

Heuristics (typosquatting, DGA, form analysis, script scanning) run entirely on your device. Only optional safe browsing checks go through secured proxies.

💳 Brand Impersonation Shield

Applied locally in the detection engine — 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay) are never misflagged, so payment data stays on your device and real checkouts are never interrupted. Clones of 300 major brands are detected locally.

🕶️ Incognito mode support

Extension can be enabled in incognito (manual activation). Private‑browsing activity is kept in an isolated incognito profile and wiped automatically once all private windows close.

📊 Optional anonymised telemetry

A toggle in settings controls event statistics (event type, category, severity, hashed user id, country) and flagged‑domain data sent to improve global detection. No email, name or full URLs are stored. Registration fires once per genuine install.

🛡️ Proxied external APIs

Calls to Google Safe Browsing, URLScan, AbuseIPDB and VirusTotal are routed through AIScamHunter servers to hide your IP and avoid exposing API keys. SSRF protection on all server proxies.

🗑️ Delete History

Permanently delete all local scan history, stats, and activity events from the Private page. Confirmation dialog prevents accidental deletion. No server‑side data is affected.

⚙️ Manifest V3 core

• Service worker (background.js)
• Declarative Net Request: 14 static rule sets (threats, 9 tracker categories, safe mode, whitelists, auth) + dynamic rules for tracker blocking
• Isolated storage, alarms, notifications
• Session & local caching

🌐 Threat intelligence sources

• Google Safe Browsing (via proxy)
• URLhaus, OpenPhish, Phishing Army
• PhishStats, PhishDestroy
• URLScan, VirusTotal, AbuseIPDB (via proxy)
• DNS reputation (Google DoH), DNSBL
• Certificate transparency (crt.sh)
• Local heuristics (typosquatting, DGA, homoglyphs)

📂 Internal rule sets

• Malware & phishing (financial, crypto, gov, shipping)
• Tracker blocking — 1,092 rules across 14 rule sets; 454,000+ domains in the 9 tracker categories (static) + dynamic rules
• Safe mode: HTTPS upgrade, block legacy plugins
• Download guard: 55 risky file types + archive scanning
• Brand impersonation: look‑alike domains, cloned logins and fake icons for 300 major brands; 81 legitimate financial domains protected from misflagging
• Threat content rules: fake "Win+R" instruction overlays, hidden shell commands, hidden AI‑assistant instructions, unwanted‑extension alerts

📈 Weighted scoring engine

• Relative weights: Google Safe Browsing 0.25, typosquatting 0.16, URL intelligence 0.14, local heuristics 0.12, PhishDestroy 0.10, URLScan 0.09, VirusTotal 0.10, AbuseIPDB 0.08, threat swarm 0.06, favicon similarity 0.06, certificate transparency (crt.sh) 0.05, external feeds 0.10, DNSBL 0.04, PhishStats 0.04, DNS reputation 0.03, SSL analysis 0.03, domain age 0.02, Wayback archive age 0.02.
• Fixed score adjustments and threshold changes for strict/safe mode
• Contextual reduction (no login/banking keywords)
• Session cache (TTL 30 min)

🪤 Dynamic tracker rules

• Categorised server database (462,941 domains, 11 categories) fetched on every service worker restart
• Domains converted to DNR dynamic rules in batches of 500
• Max 30,000 dynamic domains, rule IDs 900000+; 34 external lists used as offline fallback
• Per‑domain tracking via Chrome declarativeNetRequest matched‑rule statistics
• Rule→domain mapping stored for live statistics

🏷️ Brand Impersonation Shield

• Detects look‑alike domains, cloned login pages and fake favicons for 300 major brands (990 known icon fingerprints)
• 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks, crypto exchanges) are never misflagged
• Keeps legitimate checkouts working while threats are blocked