Two days ago I posted the intro to ScamOrNot, the little checker I built at https://scamornot-app.netlify.app — paste a message, link or wallet address, get a risk score and the red flags in plain English. This one is about the part nobody sees: tuning the engine so it shouts at scams and stays quiet for normal people.
That second half is harder. A detector that flags your bank's real SMS teaches people to ignore it within a week.
How the scoring works
The engine is one JavaScript file that runs entirely in the browser. Nothing pasted gets uploaded anywhere — I checked that choice twice, because a scam checker that collects suspicious messages would be its own problem.
Inside, there are 15 pattern families, each with a weight. Asking for a seed phrase is worth 50 points on its own, because no real company ever does that. Send-crypto-to-get-more-back scores 42. Then the smaller stuff stacks: an upfront fee to "unlock" money is 28, a friendly stranger steering you toward a trading mentor is 30, guaranteed daily returns are 22. One weak signal shouldn't convict anyone. Three or four together usually should.
Links get structural checks instead of pattern matching: brand names sitting in the wrong domain, punycode, an IP address where a hostname should be, the @ trick that hides the real destination, shorteners, the TLDs that show up in throwaway phishing kits again and again.
The false-positive problem
Here's the case that nearly broke it. A security article that says "never share your seed phrase" contains the words seed phrase. Early on, the engine read that as theft bait and scored it like an attack.
So there's a guard for protective framing now. Text that's warning you about a thing isn't the thing. It sounds obvious written down. It wasn't obvious at 2am with a regex in my hand.
Calibration ended in a place I can defend: the real scam scripts I fed it land between 45 and 70. A genuine bank SMS, real brand domains, normal messages and that security article all score 0. Not low. Zero. If the checker can't tell a bank from a scammer, it has no business existing.
What it can't do
It's pattern matching. A clean score means no strong patterns showed up, not that something is safe, and the page says so in plain words. New scripts will beat it. That's fine — it was built for the moment of doubt before you pay, send or click, not as a guarantee.
It's free for 3 checks a day, no sign-up, and it's made no money yet. Try to break the calibration if you want. Paste something legit that scores high, or a scam that scores 0, and tell me. Those two failures are the only bug reports I actually want.
Top comments (0)