Advanced Smart Analysis‑Driven Browser Security — v1.1.0

🛡️ Protezione web in tempo reale

Every visited URL is automatically scanned using reputation, heuristics, SSL analysis, redirect chains, and script behaviour. Blocks malicious pages instantly via static rule sets and dynamic declarativeNetRequest rules.

🧠 Euristiche avanzate

Rileva typosquatting, attacchi con omoglifi, domini DGA, pagine di accesso false, siti clonati e campagne di phishing appena lanciate tramite un sistema di punteggio ponderato (0-100).

🪤 Massive tracker blocking

Blocks trackers and ads from 454,000+ domains across 9 tracker categories (ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads, fingerprinters), backed by a 463,147‑domain intelligence database. Per‑domain statistics tracked in real time.

💳 Brand Impersonation Shield

Detects look‑alike domains, cloned login pages and fake icons impersonating 298 major brands, and protects 81 legitimate financial domains (Stripe, PayPal, banks, crypto exchanges) from being misflagged when you enter payment details.

⚡ Architettura Manifest V3

Fully compliant with Chrome's latest security model: service worker, declarative net request (static + dynamic rules), isolated storage, and download interception.

📊 Per‑domain tracker statistics

See exactly which tracker domains are blocked most often — sorted and ranked in the Activity tab. Filter by tracker type, view top 20 domains with live counts.

🧬 Typosquatting e attacchi con omoglifi

Rileva domini che imitano marchi utilizzando sostituzioni di caratteri, caratteri cirillici simili e trucchi fonetici: paypa1.com, g00gle.com. paypa1.com, g00gle.com.

📛 TLD sospetti e DGA

Monitors 43 high‑risk TLDs (.tk, .ml, .ga, .cf, .gq, .xyz, .top, .click and more) and uses entropy, consonant/vowel ratio and bigram analysis to detect algorithmically generated domains (DGA).

🔗 Analisi dei reindirizzamenti e degli URL abbreviati

Resolves shortened links (bit.ly, tinyurl, etc.) and follows redirect chains to block cloaked malicious destinations. Uses SSRF protection on the server proxy.

🪤 Massive tracker blocking

Blocks trackers, ads, and analytics from 454,000+ domains across 9 tracker categories — ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads and fingerprinters — drawn from a 463,147‑domain intelligence database. All blocking uses Chrome's declarativeNetRequest: static rule sets ship with the extension, and dynamic rules refresh from our servers on every service worker restart (34 external lists — EasyPrivacy, NoCoin, AdGuard and more — serve as offline fallback).

💳 Brand Impersonation Shield

Recognises 81 legitimate financial domains — Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks and crypto exchanges — so real checkouts are never interrupted, while impostor pages, look‑alike domains, cloned logins and fake favicons of 298 major brands are flagged (947 known icon fingerprints compared on every scan).

📅 Reputazione SSL avanzata

Flags brand‑new, self‑signed, expired or expiring soon (<30 days) and abusable wildcard certificates often used by phishing sites, weighted with certificate‑age tracking remembered between visits. Weighted scoring from crt.sh certificate transparency data.

🤖 Punteggio di rischio ponderato

Combina oltre 8 fonti (Google Safe Browsing, URLScan, AbuseIPDB, PhishDestroy, feed esterni, PhishStats, reputazione DNS, analisi SSL ed euristiche locali) con pesi dinamici. Punteggio da 0 a 100 con soglie regolabili.

📦 Script offuscati e miner crypto

Detects eval/atob, document.write injections, and cryptocurrency miners (CoinHive, Crypto‑Loot) in real time. The cryptominer tracker category specifically targets mining scripts.

🎣 Skimmer & keylogger blocking

Identifies malicious web skimmers and keyloggers injected into checkout and login pages, intercepting card data before it is captured by attackers.

🔑 Credential leak detection

Warns you before credentials leave the page to a suspicious destination, catching credential‑harvesting forms and cross‑site exfiltration attempts.

⚙️ Web Worker monitoring

Monitors for suspicious Web Workers that run silently in the background, a common technique used by crypto miners and skimmers.

🤖 On‑Device Content Analysis

Runs local content analysis fully inside your browser with zero external API calls — page text and structure are scored locally for phishing patterns.

🔦 Search result safety ratings

Shows a safe / suspicious / dangerous badge directly on search engine results so you can avoid risky links before clicking.

📡 Threat Radar

A live radar view of threats detected and blocked across your browsing session, giving an at‑a‑glance picture of your active protection.

🗂️ Multi‑source intelligence

Aggregates cross‑checked signals from phishing databases, domain intelligence feeds and reputation APIs into one weighted verdict.

🤝 Community threat reporting

Report confirmed threats to help protect the wider AIScamHunter community while your report stays fully anonymised.

📴 Local‑only offline detection

Run protection in a fully offline, zero‑API mode — only local heuristics and cache are used, ideal for maximum privacy.

⛔ Protezione dai download pericolosi

Blocks 55 risky file types (.exe, .msi, .bat, .scr, .apk, .iso, .lnk, macro documents such as .docm/.xlsm and more), catches disguised files (double extensions, homoglyph tricks, bait‑and‑switch URLs), pauses risky downloads from fresh or unknown sources, and can delete suspicious files.

🧾 Accessi falsi e negozi fraudolenti

Identifies cloned banking pages and fake stores via cross‑domain credential submissions, unrealistic discounts, and missing contact or legal notices.

📞 Truffe di falso supporto tecnico e quishing

Blocca schermate di blocco del browser, falsi avvisi Microsoft/Apple e campagne di phishing tramite QR code (quishing).

🖱️ Avvisi al passaggio del mouse e menu contestuale

Passa il mouse su un link: viene mostrato un avviso se è pericoloso. Clic destro → analizza il link, blocca o autorizza il dominio immediatamente.

🌍 Safe mode & Strict Private Mode

Increases detection sensitivity, forces HTTPS, blocks legacy plugins. Strict Private Mode forces DoH, blocks WebRTC leaks, auto‑cleans private tabs. Total Privacy Mode blocks third‑party cookies and disables Web Workers.

📋 Rilevamento del dirottamento degli appunti

Periodic check (every 8s, only when tab is visible) detects replaced crypto addresses or unexpected clipboard changes. Respects browser permissions policy – no errors on restricted sites.

🗑️ Delete History

From the Private page (private.html), users can delete all scan history, stats, and activity events in one action. Resets counters, clears all stored events and daily aggregates. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker statistics

Every blocked tracker request logs the originating domain. The Activity tab's tracker filter shows a ranked table of top domains with live block counts — sorted by most blocked. Stats update every 2 minutes via Chrome's declarativeNetRequest feedback API.

📊 Punteggio di rischio dinamico

Ogni pagina riceve un punteggio di rischio da 0 a 100 basato su fonti multiple di intelligence. Le soglie possono essere personalizzate (modalità rigorosa, modalità sicura).

🚨 Pagina di avviso sicura

Quando viene rilevata una minaccia critica, una schermata dettagliata mostra categoria, gravità, segnali rilevati e azioni disponibili (continuare una volta, autorizzare il dominio, segnalare un falso positivo).

🔔 Notifiche intelligenti

Avvisi immediati quando viene bloccato un sito dannoso, identificato un crypto drainer o rilevato un reindirizzamento sospetto. Disattivabili.

🪤 Massive tracker blocker

Blocks trackers, ads, and analytics from 454,000+ domains across 9 tracker categories (ad networks, ad exchanges, data brokers, mobile attribution, cryptominers, telemetry, tag managers, push ads, fingerprinters) from a 463,147‑domain database. Uses Chrome's declarativeNetRequest for efficient, native blocking. Per‑domain statistics tracked in the Activity tab.

💳 Brand Impersonation Shield

Protects 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, banks, crypto exchanges) so real checkouts never break, while look‑alike domains, cloned logins and fake icons of 298 major brands are scanned and blocked by the normal protection rules.

📊 Centro Strumenti con scanner multiplo

Complete toolkit: URL/domain scanner (batch up to 10), email risk checker, phone number validator, password vault, privacy cleaner, personal stats, persistent history of last 5 checks, sparklines and activity charts.

🔐 Generatore crittografico di password

Utilizza crypto.getRandomValues() per generare password robuste (da 8 a 64 caratteri) con lettere maiuscole, numeri, simboli e indicatore di sicurezza in tempo reale.

🧹 Pulizia privacy e distruzione dati

Rimozione con un clic delle tracce di navigazione con selezione dettagliata dei tipi di dati e intervalli temporali predefiniti. Pulisce anche IndexedDB e WebSQL.

🗑️ Delete History

From the Private page, delete all scan history, stats, and activity events in one action. Resets all counters and clears stored data. Confirmation dialog prevents accidental deletion.

🌐 Local allow/block lists

Users can manually add domains to personal allowlist or blocklist. They override global rules and persist locally across browser sessions — no account or sync service required.

⚙️ Impostazioni avanzate

Enable/disable real‑time shield, safe mode, tracker blocking, download guard, notifications, strict mode, telemetry, strict private mode, total privacy mode. Reset statistics, clear activity log.

🌍 18 languages + RTL

Internazionalizzazione completa incluso l'arabo (da destra a sinistra). Il tema chiaro/scuro si sincronizza con le preferenze del sistema.

🔗 Sincronizzazione amministrativa e segnalazione falsi positivi

Gli utenti possono segnalare falsi positivi dalla pagina di avviso. Gli amministratori esaminano le segnalazioni e aggiornano le liste globali di autorizzazione o blocco. L'estensione aggiorna le liste ogni ora.

🪤 Activity tab tracker filter

The Activity tab includes a dedicated tracker filter (🪤) that shows per‑domain block statistics — top 20 domains sorted by most blocked, with live counts from Chrome's declarativeNetRequest feedback API.

🧪 Controllo truffe email e telefono

Verifica indirizzi email temporanei o a bassa reputazione (API Disify) e numeri di telefono associati a prefissi noti per le truffe. Disponibile nel Centro Strumenti.

🧠 On‑Device ML classifier

A local machine‑learning model scores every page directly in your browser. Inference and features stay on your device — no page content is ever sent to a server for the model.

💬 Scam‑text detection (9 languages)

Reads page text against a scam‑wording taxonomy covering English, French, Spanish, German, Italian, Portuguese, Arabic, Chinese and Russian — tech support, romance, smishing, investment, callback and more.

🗃️ Site Memory (30 days)

Blocked and warned sites are remembered locally for 30 days with per‑domain counts, so repeat offenders are recognised instantly and your protection history stays visible across sessions.

🌐 Scanner URL / Domini (multiplo)

Check any URL or domain with multi‑source analysis (Google Safe Browsing, URLScan, PhishDestroy, local heuristics). Returns risk score, category, detected signals. Supports batch scanning of up to 10 URLs at once. Persistent history of last 5 checks with sparklines.

📧 Email risk checker

Detects disposable or low‑reputation email addresses via Disify API (HTTPS). Checks if email is valid, disposable, or has low reputation score. Batch mode available.

📞 Phone number validator

Verifies phone numbers against a curated list of known scam prefixes and flags likely scam numbers. Country selection included.

📊 Grafici attività e sparklines

Visualises scans, blocked threats, and tracker blocks over 24h, 7 days, and 30 days. Sparkline graphs on stat cards show weekly trends. Dedicated tracker stat card shows total trackers blocked.

🔐 Cassaforte password (generatore sicuro)

Genera password crittograficamente sicure (crypto.getRandomValues). Adjustable length (8‑64 chars), character sets, and a live strength meter (weak → very strong).

🧹 Pulizia privacy e distruzione dati

Rimozione con un clic delle tracce di navigazione con selezione dettagliata dei tipi di dati e intervalli temporali predefiniti. Pulisce anche IndexedDB e WebSQL.

🗑️ Delete History

From the Private page, permanently delete all scan history, stats, activity events, and daily aggregates. Resets all counters (pages scanned, threats blocked, warnings, downloads, trackers) to zero. Confirmation dialog prevents accidental deletion.

🪤 Per‑domain tracker stats

Click the tracker stat card in the Activity tab to see a ranked table of top 20 tracker domains by block count. Data comes from Chrome's declarativeNetRequest feedback API — shows real blocked requests, not estimates.

💸 Rilevamento crypto drainer

Monitora chiamate Web3 pericolose come approve, transferFrom, personal_sign, eth_signTypedData, wallet_switchEthereumChain and more on pages that inject window.ethereum or window.solana.

🎁 Giveaway e airdrop falsi

Analizza testi e timer di conto alla rovescia per rilevare truffe come "Elon Musk giveaway", "raddoppia le tue crypto" e falsi airdrop.

👛 Pagine di portafogli falsi

Identifica siti di phishing che imitano MetaMask, Binance, Coinbase, Ledger, Trust Wallet, Phantom e altri, utilizzando typosquatting e sottodomini ingannevoli.

📋 Dirottamento degli appunti (crypto)

Rileva quando un indirizzo crypto copiato (ad esempio un indirizzo Ethereum che inizia con 0x...) viene sostituito silenziosamente da un indirizzo dannoso. Attiva un avviso critico.

📢 User false‑positive reporting

From the warning page or popup, users can report a blocked domain as a false positive. The report includes domain, timestamp, and anonymised user hash.

🔧 Admin actions

Trust → adds to global allowlist; Block → adds to global blocklist; Resolve → removes the report without global changes. Decisions sync to all users via shared JSON files.

🔄 Hourly synchronisation

The extension polls the server every hour for updated trusted/blocked lists. Admin changes propagate to all users within ≤60 minutes.

📊 Anonymous telemetry (optional)

Anonymous event statistics (event type, category, severity, hashed user id, country) plus the domain of flagged events are sent to improve detection for the whole community. No email, no name and no full browsing URLs are stored. Telemetry is enabled by default and can be disabled with one toggle in settings.

👥 User counting

Total installations are counted via the register telemetry event, which fires only once per genuine first install (stored in chrome.storage.local). Reinstalls after storage clear also register. The service worker restart on idle does not re-trigger registration — the _hasRegistered flag survives restarts.

🪤 Tracker statistics dashboard

The admin dashboard shows real‑time tracker block counts, per‑domain statistics from the dynamic rule matching, and threat activity trends. Updates hourly via telemetry data.

🔒 Local processing

Heuristics (typosquatting, DGA, form analysis, script scanning) run entirely on your device. Only optional safe browsing checks go through secured proxies.

💳 Brand Impersonation Shield

Applied locally in the detection engine — 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay) are never misflagged, so payment data stays on your device and real checkouts are never interrupted. Clones of 298 major brands are detected locally.

🕶️ Incognito mode support

Extension can be enabled in incognito (manual activation). Private‑browsing activity is kept in an isolated incognito profile and wiped automatically once all private windows close.

📊 Optional anonymised telemetry

A toggle in settings controls event statistics (event type, category, severity, hashed user id, country) and flagged‑domain data sent to improve global detection. No email, name or full URLs are stored. Registration fires once per genuine install.

🛡️ Proxied external APIs

Calls to Google Safe Browsing, URLScan, AbuseIPDB and VirusTotal are routed through AIScamHunter servers to hide your IP and avoid exposing API keys. SSRF protection on all server proxies.

🗑️ Delete History

Permanently delete all local scan history, stats, and activity events from the Private page. Confirmation dialog prevents accidental deletion. No server‑side data is affected.

⚙️ Manifest V3 core

• Service worker (background.js)
• Declarative Net Request: 14 static rule sets (threats, 9 tracker categories, safe mode, whitelists, auth) + dynamic rules for tracker blocking
• Isolated storage, alarms, notifications
• Session & local caching

🌐 Threat intelligence sources

• Google Safe Browsing (via proxy)
• URLhaus, OpenPhish, Phishing Army
• PhishStats, PhishDestroy
• URLScan, VirusTotal, AbuseIPDB (via proxy)
• DNS reputation (Google DoH), DNSBL
• Certificate transparency (crt.sh)
• Local heuristics (typosquatting, DGA, homoglyphs)

📂 Internal rule sets

• Malware & phishing (financial, crypto, gov, shipping)
• Tracker blocking — 1,093 rules across 14 rule sets; 454,000+ domains in the 9 tracker categories (static) + dynamic rules
• Safe mode: HTTPS upgrade, block legacy plugins
• Download guard: 55 risky file types + archive scanning
• Brand impersonation: look‑alike domains, cloned logins and fake icons for 298 major brands; 81 legitimate financial domains protected from misflagging

📈 Weighted scoring engine

• Relative weights: Google Safe Browsing 0.25, typosquatting 0.16, URL intelligence 0.14, local heuristics 0.12, PhishDestroy 0.10, URLScan 0.09, VirusTotal 0.10, AbuseIPDB 0.08, threat swarm 0.06, favicon similarity 0.06, certificate transparency (crt.sh) 0.05, external feeds 0.10, DNSBL 0.04, PhishStats 0.04, DNS reputation 0.03, SSL analysis 0.03, domain age 0.02, Wayback archive age 0.02.
• Fixed score adjustments and threshold changes for strict/safe mode
• Contextual reduction (no login/banking keywords)
• Session cache (TTL 30 min)

🪤 Dynamic tracker rules

• Categorised server database (463,147 domains, 11 categories) fetched on every service worker restart
• Domains converted to DNR dynamic rules in batches of 500
• Max 30,000 dynamic domains, rule IDs 900000+; 34 external lists used as offline fallback
• Per‑domain tracking via Chrome declarativeNetRequest matched‑rule statistics
• Rule→domain mapping stored for live statistics

🏷️ Brand Impersonation Shield

• Detects look‑alike domains, cloned login pages and fake favicons for 298 major brands (947 known icon fingerprints)
• 81 legitimate financial domains (Stripe, PayPal, Apple Pay, Google Pay, Square, Klarna, Adyen, banks, crypto exchanges) are never misflagged
• Keeps legitimate checkouts working while threats are blocked