ScamLens

Dwg. ScamLens / Transparency

What ScamLens checks

This page is generated from the live rule registry: 18 rules, ruleset 1.0.1. Severity describes how strongly a pattern is associated with abuse in general, never a probability that a particular message is malicious.

URL structure

Properties of a link that are visible without ever visiting it.

  • IP address used instead of a domain

    highURL_IP_LITERAL v1.0.0

    Flags URLs whose host is a raw IPv4/IPv6 address rather than a domain name.

  • Deceptive subdomain structure

    highURL_DECEPTIVE_SUBDOMAIN v1.0.0

    Flags hostnames whose subdomain contains a known brand name or a domain-like prefix (e.g. paypal.com.account-security.example.net) designed to mislead a quick glance.

  • Look-alike domain

    highURL_LOOKALIKE_DOMAIN v1.0.0

    Flags registrable domains that visually imitate a known brand through character substitution (paypa1, micros0ft, arnazon) or a one-character difference.

  • Username trick in URL

    highURL_USERINFO v1.0.0

    Flags URLs containing an "@" credential section (e.g. https://paypal.com@evil.example), where everything before the @ is ignored by the browser.

  • Shortened link

    lowURL_SHORTENER v1.0.0

    Flags links that use a public URL-shortening service, which hides the true destination.

  • Malformed URL

    lowURL_MALFORMED v1.0.0

    Flags URL-looking tokens that could not be parsed as valid web addresses.

  • Unusually long or deep hostname

    lowURL_UNUSUAL_STRUCTURE v1.0.0

    Flags hostnames that are unusually long or contain many nested subdomains, a pattern common in throwaway phishing infrastructure.

  • Internationalized (punycode) domain

    infoURL_PUNYCODE v1.0.0

    Flags hostnames containing punycode labels (xn--). Many internationalized domains are legitimate; this is an indicator to inspect, not proof of anything.

Email identity

Sender fields, Reply-To and pasted authentication results.

  • Display name imitates a brand

    highEMAIL_DISPLAY_NAME_BRAND_MISMATCH v1.0.0

    Flags senders whose display name contains a known brand while the actual sending domain does not belong to that brand.

  • Reply-To goes to a different domain

    mediumEMAIL_REPLY_TO_MISMATCH v1.0.0

    Flags emails whose Reply-To domain differs from the From domain, so replies go somewhere other than the apparent sender.

  • Email authentication reported failures

    mediumEMAIL_AUTH_FAILURE v1.0.0

    Flags SPF/DKIM/DMARC failure results found in pasted headers, with the caveat that pasted headers cannot be independently verified.

Social-engineering language

Persuasion patterns in the wording itself.

  • Gift card or cryptocurrency payment

    highLANG_GIFTCARD_CRYPTO v1.0.0

    Detects requests to pay with gift cards or cryptocurrency.

  • Artificial urgency

    mediumLANG_URGENCY v1.0.1

    Detects pressure phrases pushing the reader to act before thinking.

  • Fear or threat language

    mediumLANG_THREAT v1.0.1

    Detects threats of suspension, permanent loss, or legal consequences.

  • Credential request

    mediumLANG_CREDENTIAL_REQUEST v1.0.0

    Detects requests to enter, confirm, or share passwords, codes, or login details.

  • Payment request

    mediumLANG_PAYMENT_REQUEST v1.0.0

    Detects requests to pay fees, settle invoices, or update payment details.

  • Request for secrecy

    mediumLANG_SECRECY v1.0.0

    Detects instructions to keep the conversation secret.

HTML deception

Mismatches between what a link shows and where it actually goes.

  • Link text does not match destination

    highHTML_LINK_TEXT_MISMATCH v1.0.0

    Flags HTML links whose visible text shows one domain while the underlying href points to a different registrable domain.

Known limits: the brand list covers 20 widely-impersonated brands, language patterns are English-only, pasted headers cannot be cryptographically re-verified, and shortened links are not resolved because submitted URLs are never visited.