scamshield slim - code only, weights via model repo

.gitignore

@@ -0,0 +1,3 @@
+__pycache__/
+*.pyc
+.env

app.py

@@ -0,0 +1,152 @@
+import sys, os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "smishing_detector"))
+
+import json
+import gradio as gr
+from predictor import SmishingPredictor
+from explainability.shap_explainer import SmishingExplainer
+
+CHECKPOINT = os.path.join(os.path.dirname(__file__), "smishing_detector", "best_model.pt")
+
+print("Loading ScamShield model...")
+predictor = SmishingPredictor(CHECKPOINT)
+print("Loading SHAP explainer...")
+explainer = SmishingExplainer(predictor)
+print("Model loaded. Ready.")
+
+def analyze(message):
+    if not message or not message.strip():
+        return "⚠️ Please enter a message.", None, None
+
+    result = predictor.predict(message)
+
+    label = result["label"]
+    risk = result["risk_level"]
+    conf = result["confidence"]
+    lang = result.get("language", "?")
+    gc = result.get("green_channel", False)
+    gc_reason = result.get("green_reason", "")
+
+    # --- Verdict ---
+    if label == "safe":
+        verdict = f"## ✅ Safe\nGreen Channel cleared: {gc_reason}"
+    elif label == "spam":
+        emoji = "🔴" if risk == "high" else "🟠"
+        verdict = f"## {emoji} {label.upper()} — {risk.upper()} RISK"
+    else:
+        verdict = f"## 🟢 {label.upper()} — LOW RISK"
+
+    verdict += f"\nConfidence: **{conf:.1%}** | Threshold: {predictor.threshold} | Language: {lang}"
+
+    if gc:
+        verdict += f"\n\n🛡️ Green Channel: {gc_reason}"
+
+    # --- URL signals ---
+    urls = result.get("url_signals", {})
+    url_text = ""
+    if urls.get("has_url"):
+        url_text = "### 🔗 URL Analysis\n"
+        flags = []
+        if urls.get("has_ip_url"):      flags.append("🔴 IP address instead of domain")
+        if urls.get("has_shortened_url"): flags.append("🔴 URL shortener — hides real destination")
+        if urls.get("suspicious_tld"):  flags.append("🟠 Suspicious TLD (.xyz, .tk, .top etc.)")
+        if urls.get("has_http") and not urls.get("has_https"):
+            flags.append("🟠 HTTP (not encrypted)")
+        if urls.get("has_legit_domain"): flags.append("🟢 Legitimate domain detected")
+        url_text += "\n".join(f"- {f}" for f in flags) if flags else "- No obvious threats"
+        url_text += f"\nLinks found: {urls.get('num_urls', 0)}"
+
+    # --- Text signals ---
+    text = result.get("text_signals", {})
+    text_info = "### 📝 Text Signals\n"
+    text_info += f"- Chars: {text.get('num_chars', 0)} | Words: {text.get('num_words', 0)}\n"
+    text_info += f"- Uppercase: {text.get('pct_upper', 0)*100:.0f}% | Digits: {text.get('pct_digits', 0)*100:.0f}%\n"
+    text_info += f"- Urgency keywords: {text.get('urgency_count', 0)}\n"
+    text_info += f"- Phone number: {'Yes' if text.get('has_phone') else 'No'} | Currency symbol: {'Yes' if text.get('has_currency') else 'No'}"
+
+    # --- Internal scores ---
+    scores = "### ⚙️ Scores\n"
+    scores += f"Neural: {result.get('_neural_score', 0):.3f} | Rule: {result.get('_rule_score', 0):.3f} | Ham: {result.get('_ham_rule_score', 0):.3f}"
+
+    # --- SHAP explanation ---
+    shap_text = "### 🔬 SHAP Explainability\n"
+    try:
+        explanation = explainer.explain_text(message, num_features=8)
+        if explanation["top_spam_words"]:
+            shap_text += "*Spam indicators:*\n"
+            for word, val in explanation["top_spam_words"]:
+                shap_text += f"- `{word}` +{val:.3f}\n"
+        if explanation["top_ham_words"]:
+            shap_text += "*Ham indicators:*\n"
+            for word, val in explanation["top_ham_words"]:
+                shap_text += f"- `{word}` {val:.3f}\n"
+        if not explanation["top_spam_words"] and not explanation["top_ham_words"]:
+            shap_text += "No strong word-level signals found."
+    except Exception:
+        shap_text += "SHAP explanation unavailable for this message."
+
+    return verdict, url_text if url_text else "No URLs found", text_info + "\n\n" + scores, shap_text
+
+
+examples = [
+    "URGENT: Your SBI account has been suspended. Verify KYC now at http://sbi-kyc-verify.xyz or funds frozen.",
+    "HDFC Bank: Rs.25,000 credited to a/c XX4521. Avl bal: Rs.1,42,356. -HDFC Bank",
+    "Aapka bijli connection aaj raat 9:30 baje band ho jayega. Turant call karein: 9876543210",
+    "Airtel: Your recharge of Rs.239 is successful. Validity 28 days. -Airtel",
+    "CBI notice: Aapke khilaf money laundering case darj. Digital arrest warrant. Call 9911000000.",
+    "PhonePe: Rs.500 received from Rahul Kumar. UPI Ref: 4893721019.",
+    "बधाई हो! आपको KBC लॉटरी में ₹25,00,000 का इनाम मिला। http://kbc-lottery.ml/win",
+    "Your OTP for SBI login is 483921. Valid 10 mins. Do NOT share. -SBI",
+    "Dear user, your UPI ID expires in 24h. Renew at http://upi-renew.club/verify",
+    "Mom, I landed safely. Will call from the hotel in an hour.",
+]
+
+with gr.Blocks(title="ScamShield — Smishing Detector") as demo:
+    gr.Markdown("# 🛡️ ScamShield — Multilingual Smishing Detector")
+    gr.Markdown("Detect SMS phishing (smishing) in English, Hindi, and Hinglish. "
+                "Powered by XLM-RoBERTa + hand-crafted URL/text features + Google Safe Browsing.")
+
+    with gr.Row():
+        with gr.Column(scale=2):
+            inp = gr.Textbox(label="SMS Message", placeholder="Paste the SMS message here...",
+                             lines=4, max_lines=10)
+            btn = gr.Button("🔍 Analyze", variant="primary", size="lg")
+
+        with gr.Column(scale=3):
+            verdict = gr.Markdown(label="Verdict")
+            with gr.Tabs():
+                with gr.TabItem("URL Analysis"):
+                    url_box = gr.Markdown()
+                with gr.TabItem("Text Signals"):
+                    text_box = gr.Markdown()
+                with gr.TabItem("SHAP Explainability"):
+                    shap_box = gr.Markdown()
+
+    btn.click(fn=analyze, inputs=inp, outputs=[verdict, url_box, text_box, shap_box])
+    inp.submit(fn=analyze, inputs=inp, outputs=[verdict, url_box, text_box, shap_box])
+
+    gr.Examples(examples=examples, inputs=inp, label="Try these examples")
+
+    gr.Markdown("---\n"
+                "**Model:** XLM-RoBERTa (xlm-roberta-base) | **Threshold:** 0.55 | "
+                "**Languages:** English · Hindi · Hinglish | "
+                "**Features:** 9 URL signals + 8 text signals | **F1:** 0.98")
+
+
+def api_predict(message: str) -> str:
+    return json.dumps(predictor.predict(message), ensure_ascii=False)
+
+
+api = gr.Interface(
+    fn=api_predict,
+    inputs=gr.Textbox(label="message"),
+    outputs=gr.Textbox(label="result"),
+    api_name="predict",
+    title="ScamShield API",
+)
+
+
+if __name__ == "__main__":
+    demo.queue(default_concurrency_limit=1)
+    gr.mount_gradio_app(demo, api, path="/api")
+    demo.launch()

requirements.txt

@@ -0,0 +1,11 @@
+torch>=2.0.0
+transformers>=4.35.0
+tldextract>=3.4.0
+numpy>=1.24.0
+sentencepiece>=0.1.99
+protobuf>=3.20.0
+requests>=2.31.0
+python-dotenv>=1.0.0
+gradio>=5.0.0
+pandas>=2.0.0
+shap>=0.43.0

smishing_detector/adversarial/evasion.py

@@ -0,0 +1,113 @@
+import random
+import pandas as pd
+import numpy as np
+from sklearn.metrics import f1_score
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from predictor import SmishingPredictor
+
+
+CHARSWAP_MAP = {
+    'a': '@', 'e': '3', 'i': '1', 'o': '0',
+    's': '$', 't': '7', 'l': '1', 'g': '9'
+}
+
+
+def charswap(text: str, rate: float = 0.3) -> str:
+    chars = list(text)
+    eligible_indices = [i for i, c in enumerate(chars) if c.lower() in CHARSWAP_MAP]
+
+    if not eligible_indices:
+        return text
+
+    num_swaps = max(1, int(len(eligible_indices) * rate))
+    indices_to_swap = random.sample(eligible_indices, min(num_swaps, len(eligible_indices)))
+
+    for i in indices_to_swap:
+        chars[i] = CHARSWAP_MAP[chars[i].lower()]
+
+    return ''.join(chars)
+
+
+def eda_attack(text: str, rate: float = 0.2) -> str:
+    words = text.split()
+
+    if len(words) < 2:
+        return text
+
+    num_to_delete = max(1, int(len(words) * rate))
+    indices_to_delete = random.sample(range(len(words)), num_to_delete)
+
+    words = [w for i, w in enumerate(words) if i not in indices_to_delete]
+
+    if len(words) >= 2:
+        for i in range(0, len(words) - 1, 2):
+            if random.random() < 0.5:
+                words[i], words[i + 1] = words[i + 1], words[i]
+
+    return ' '.join(words)
+
+
+def spacing_attack(text: str) -> str:
+    urgency_words = {'urgent', 'winner', 'free', 'prize', 'cash', 'claim', 'verify', 'act now'}
+
+    words = text.split()
+    modified = []
+
+    for word in words:
+        if word.lower() in urgency_words:
+            modified.append(' '.join(list(word)))
+        else:
+            modified.append(word)
+
+    return ' '.join(modified)
+
+
+def hybrid_attack(text: str) -> str:
+    text = charswap(text, rate=0.3)
+    text = eda_attack(text, rate=0.2)
+    text = spacing_attack(text)
+    return text
+
+
+def run_adversarial_evaluation(
+    predictor: SmishingPredictor,
+    test_df: pd.DataFrame,
+    spam_only: bool = True
+) -> pd.DataFrame:
+    if spam_only:
+        messages = test_df[test_df['label'] == 1]['message'].tolist()
+        true_labels = [1] * len(messages)
+    else:
+        messages = test_df['message'].tolist()
+        true_labels = test_df['label'].tolist()
+
+    results = []
+
+    for attack_name, attack_fn in [('CharSwap', charswap), ('EDA', eda_attack), ('Spacing', spacing_attack), ('Hybrid', hybrid_attack)]:
+        original_preds = []
+        attacked_preds = []
+
+        for msg in messages:
+            original_result = predictor.predict(msg)
+            original_preds.append(1 if original_result['label'] == 'spam' else 0)
+
+            attacked_msg = attack_fn(msg)
+            attacked_result = predictor.predict(attacked_msg)
+            attacked_preds.append(1 if attacked_result['label'] == 'spam' else 0)
+
+        original_f1 = f1_score(true_labels, original_preds, zero_division=0)
+        attacked_f1 = f1_score(true_labels, attacked_preds, zero_division=0)
+        accuracy_drop = original_f1 - attacked_f1
+
+        results.append({
+            'attack_type': attack_name,
+            'original_f1': original_f1,
+            'attacked_f1': attacked_f1,
+            'accuracy_drop': accuracy_drop
+        })
+
+    return pd.DataFrame(results)

smishing_detector/app/flask_api.py

@@ -0,0 +1,192 @@
+import os
+import sys
+from flask import Flask, request, jsonify, render_template
+from flask_cors import CORS
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from predictor import SmishingPredictor
+from explainability.shap_explainer import SmishingExplainer
+from utils.safe_browsing import check_domain_status
+from utils.encryption import decrypt_message, get_key_hex
+
+app = Flask(__name__, template_folder=os.path.join(os.path.dirname(__file__), 'templates'))
+CORS(app)
+
+# Model checkpoint path - relative to smishing_detector root
+PROJECT_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+CHECKPOINT_PATH = os.path.join(PROJECT_ROOT, "best_model.pt")
+
+predictor = None
+explainer = None
+
+if os.path.exists(CHECKPOINT_PATH):
+    try:
+        predictor = SmishingPredictor(CHECKPOINT_PATH)
+        explainer = SmishingExplainer(predictor)
+    except Exception as e:
+        print(f"Warning: Failed to load model: {e}")
+        predictor = None
+        explainer = None
+
+
+@app.route('/')
+def index():
+    return render_template('index.html')
+
+
+
+@app.route('/check-domain', methods=['POST'])
+def check_domain():
+    """Check if a domain is legitimate using Google Safe Browsing API."""
+    if not request.get_json() or 'domain' not in request.get_json():
+        return jsonify({"error": "Missing 'domain' field"}), 400
+    
+    domain = request.get_json()['domain'].lower().strip()
+    
+    if not domain:
+        return jsonify({"error": "Domain cannot be empty"}), 400
+    
+    try:
+        status = check_domain_status(domain)
+        return jsonify({
+            "domain": domain,
+            "is_legitimate": status == "known_safe",
+            "is_malicious": status == "known_malicious",
+            "status": status
+        })
+    except Exception as e:
+        return jsonify({
+            "error": f"Failed to check domain: {str(e)}"
+        }), 500
+
+
+@app.route('/health', methods=['GET'])
+def health():
+    if predictor is None:
+        return jsonify({
+            "status": "error",
+            "model": "SmishingDetector (XLM-RoBERTa + URL features)",
+            "error": "Model checkpoint not found. Run train.py first."
+        }), 503
+
+    return jsonify({
+        "status": "ok",
+        "model": "SmishingDetector (XLM-RoBERTa · EN/HI/Hinglish)",
+        "encryption": "AES-256-CBC"
+    })
+
+
+@app.route('/predict', methods=['POST'])
+def predict():
+    if predictor is None:
+        return jsonify({
+            "error": "Model checkpoint not found. Run train.py first."
+        }), 503
+
+    data = request.get_json()
+    if not data or 'message' not in data:
+        return jsonify({"error": "Missing 'message' field"}), 400
+
+    message = data['message']
+    result = predictor.predict(message)
+
+    result['message'] = message
+
+    return jsonify(result)
+
+
+@app.route('/batch_predict', methods=['POST'])
+def batch_predict():
+    if predictor is None:
+        return jsonify({
+            "error": "Model checkpoint not found. Run train.py first."
+        }), 503
+
+    data = request.get_json()
+    if not data or 'messages' not in data:
+        return jsonify({"error": "Missing 'messages' field"}), 400
+
+    messages = data['messages']
+    results = [predictor.predict(msg) for msg in messages]
+
+    return jsonify({
+        "results": results,
+        "count": len(results)
+    })
+
+
+@app.route('/predict_secure', methods=['POST'])
+def predict_secure():
+    """
+    Encrypted prediction endpoint for mobile app.
+    Expects: { "message": "<AES-256-CBC base64 ciphertext>",
+               "address": "<sender>" (optional) }
+    Returns same shape as /predict but with encryption_used: true.
+    """
+    if predictor is None:
+        return jsonify({"error": "Model not loaded."}), 503
+
+    data = request.get_json()
+    if not data or 'message' not in data:
+        return jsonify({"error": "Missing 'message' field"}), 400
+
+    try:
+        plaintext = decrypt_message(data['message'])
+    except Exception as e:
+        return jsonify({"error": f"Decryption failed: {e}"}), 400
+
+    result = predictor.predict(plaintext)
+    result['message']          = plaintext
+    result['encryption_used']  = True
+    return jsonify(result)
+
+
+@app.route('/api/encryption-key', methods=['GET'])
+def encryption_key():
+    """
+    Returns the AES-256 key for the mobile app.
+    Protected by X-App-Token header (set APP_TOKEN in .env).
+    """
+    expected = os.getenv('APP_TOKEN', 'scamshield-dev-token')
+    if request.headers.get('X-App-Token') != expected:
+        return jsonify({'error': 'Unauthorized'}), 401
+    return jsonify({'key': get_key_hex(), 'algorithm': 'AES-256-CBC'})
+
+
+@app.route('/explain', methods=['POST'])
+def explain():
+    if predictor is None or explainer is None:
+        return jsonify({
+            "error": "Model checkpoint not found. Run train.py first."
+        }), 503
+
+    data = request.get_json()
+    if not data or 'message' not in data:
+        return jsonify({"error": "Missing 'message' field"}), 400
+
+    message = data['message']
+
+    result = predictor.predict(message)
+
+    try:
+        explanation = explainer.explain_text(message, num_features=10)
+    except Exception as e:
+        return jsonify({
+            "error": f"SHAP explanation failed: {str(e)}"
+        }), 500
+
+    return jsonify({
+        "label": result['label'],
+        "confidence": result['confidence'],
+        "top_spam_words": explanation['top_spam_words'],
+        "top_ham_words": explanation['top_ham_words'],
+        "feature_importances": explanation['feature_importances']
+    })
+
+
+if __name__ == '__main__':
+    host = os.getenv('SCAMSHIELD_HOST', '0.0.0.0')
+    port = int(os.getenv('SCAMSHIELD_PORT', '5000'))
+    debug = os.getenv('SCAMSHIELD_DEBUG', 'true').lower() in ('1', 'true', 'yes')
+    app.run(host=host, port=port, debug=debug)

smishing_detector/app/streamlit_app.py

@@ -0,0 +1,147 @@
+import os
+import sys
+import streamlit as st
+import matplotlib.pyplot as plt
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from predictor import SmishingPredictor
+from explainability.shap_explainer import SmishingExplainer
+
+CHECKPOINT_PATH = "best_model.pt"
+
+st.set_page_config(page_title="Smishing Detector", page_icon="🔍")
+
+st.markdown("""
+<style>
+    .main-header {
+        font-size: 2.5rem;
+        font-weight: bold;
+        margin-bottom: 0;
+    }
+    .sub-header {
+        font-size: 1rem;
+        color: #666;
+        margin-top: 0;
+    }
+    .footer {
+        font-size: 0.8rem;
+        color: #888;
+        text-align: center;
+        margin-top: 2rem;
+    }
+</style>
+""", unsafe_allow_html=True)
+
+
+@st.cache_resource
+def load_predictor():
+    if not os.path.exists(CHECKPOINT_PATH):
+        return None
+    return SmishingPredictor(CHECKPOINT_PATH)
+
+
+def load_explainer(_predictor):
+    if _predictor is None:
+        return None
+    return SmishingExplainer(_predictor)
+
+
+predictor = load_predictor()
+explainer = load_explainer(predictor) if predictor else None
+
+st.markdown('<p class="main-header">🔍 Smishing Detector</p>', unsafe_allow_html=True)
+st.markdown('<p class="sub-header">Powered by XLM-RoBERTa + URL Feature Fusion · English, Hindi &amp; Hinglish Support</p>', unsafe_allow_html=True)
+
+if predictor is None:
+    st.warning(f"Model checkpoint not found. Please run `python train.py` first to train the model.")
+    st.stop()
+
+spam_sample = "URGENT: Your SBI account is SUSPENDED. Verify now at http://bit.ly/sbi-verify or lose access."
+ham_sample = "Hey! Are we still on for dinner tonight at 7? Let me know if plans change."
+
+col1, col2 = st.columns([2, 1])
+
+with col1:
+    def update_sample():
+        sample = st.session_state.sample_selector
+        if sample == "Spam Sample":
+            st.session_state.message_input = spam_sample
+        elif sample == "Ham Sample":
+            st.session_state.message_input = ham_sample
+
+    message_input = st.text_area("Enter SMS message to analyse:", key="message_input", height=150)
+    btn_col1, btn_col2 = st.columns([1, 1])
+    with btn_col1:
+        analyse_btn = st.button("Analyse", type="primary", use_container_width=True)
+    with btn_col2:
+        st.selectbox("Load sample:", ["", "Spam Sample", "Ham Sample"], index=0, key="sample_selector", on_change=update_sample)
+
+with col2:
+    st.write("**Sample Messages:**")
+    st.code(spam_sample[:60] + "...")
+    st.code(ham_sample[:60] + "...")
+
+if analyse_btn and message_input:
+    result = predictor.predict(message_input)
+
+    st.divider()
+
+    if result['label'] == 'spam':
+        st.markdown("## 🚨 SPAM DETECTED")
+    else:
+        st.markdown("## ✅ HAM (Legitimate)")
+
+    m1, m2, m3 = st.columns(3)
+    m1.metric("Prediction", result['label'].upper())
+    m2.metric("Confidence", f"{result['confidence']*100:.1f}%")
+    m3.metric("Risk Level", result['risk_level'].upper())
+
+    # Language detection display
+    from utils.multilingual_loader import detect_language
+
+    detected_lang = detect_language(message_input)
+    lang_display = {
+        'english':  '🇬🇧 English',
+        'hindi':    '🇮🇳 Hindi (हिंदी)',
+        'hinglish': '🇮🇳 Hinglish'
+    }
+
+    st.info(f"**Detected Language:** {lang_display.get(detected_lang, '🌐 Unknown')}")
+
+    fig, ax = plt.subplots(figsize=(8, 2))
+    prob = result['confidence']
+    ax.barh(['Message'], [prob], color='#d62728' if result['label'] == 'spam' else '#2ca02c')
+    ax.barh(['Message'], [1-prob], left=[prob], color='#2ca02c' if result['label'] == 'spam' else '#d62728')
+    ax.axvline(x=0.5, color='black', linestyle='--', linewidth=1, label='Threshold')
+    ax.set_xlim(0, 1)
+    ax.set_yticks([])
+    ax.set_xlabel('Probability')
+    st.pyplot(fig)
+
+    url_cols, text_cols = st.columns(2)
+
+    with url_cols:
+        st.write("**URL Risk Signals:**")
+        url_signals = result['url_signals']
+        for key, value in url_signals.items():
+            flag = " ⚠️" if value and key in ['has_url', 'suspicious_tld', 'has_ip_url', 'has_shortened_url', 'has_http'] else ""
+            st.write(f"`{key}`: **{value}**{flag}")
+
+    with text_cols:
+        st.write("**Text Risk Signals:**")
+        text_signals = result['text_signals']
+        for key, value in text_signals.items():
+            st.write(f"`{key}`: **{value}**")
+
+    if explainer:
+        try:
+            shap_fig = explainer.plot_explanation(message_input)
+            st.pyplot(shap_fig)
+        except Exception as e:
+            st.caption(f"SHAP explanation unavailable: {str(e)}")
+
+    with st.expander("View Raw Analysis"):
+        st.json(result)
+
+st.markdown('<p class="footer">ScamShield · Model: XLM-RoBERTa + URL Feature Fusion</p>', unsafe_allow_html=True)

smishing_detector/app/templates/index.html

@@ -0,0 +1,933 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="UTF-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>
+<title>ScamShield AI — Threat Scanner</title>
+<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,400&display=swap" rel="stylesheet"/>
+<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css" rel="stylesheet"/>
+<style>
+/* ── Tokens ────────────────────────────────────────────────────────────── */
+[data-theme="dark"]{
+  --bg:#0d1117;
+  --bg2:#161b22;
+  --surface:#1c2333;
+  --surface2:#21293d;
+  --border:#2d3748;
+  --border2:#3a4a60;
+  --accent:#3b82f6;
+  --accent-h:#2563eb;
+  --accent-soft:rgba(59,130,246,.12);
+  --accent-border:rgba(59,130,246,.35);
+  --red:#ef4444;
+  --red-soft:rgba(239,68,68,.1);
+  --red-border:rgba(239,68,68,.3);
+  --green:#22c55e;
+  --green-soft:rgba(34,197,94,.1);
+  --green-border:rgba(34,197,94,.3);
+  --amber:#f59e0b;
+  --amber-soft:rgba(245,158,11,.1);
+  --amber-border:rgba(245,158,11,.3);
+  --text:#f0f6fc;
+  --text2:#8b949e;
+  --text3:#484f58;
+  --shadow:0 0 0 1px rgba(255,255,255,.04),0 4px 24px rgba(0,0,0,.4);
+  --shadow2:0 8px 40px rgba(0,0,0,.5);
+  --input-bg:#0d1117;
+}
+[data-theme="light"]{
+  --bg:#f6f8fa;
+  --bg2:#ffffff;
+  --surface:#ffffff;
+  --surface2:#f6f8fa;
+  --border:#d0d7de;
+  --border2:#b1bac4;
+  --accent:#2563eb;
+  --accent-h:#1d4ed8;
+  --accent-soft:rgba(37,99,235,.08);
+  --accent-border:rgba(37,99,235,.25);
+  --red:#dc2626;
+  --red-soft:rgba(220,38,38,.07);
+  --red-border:rgba(220,38,38,.25);
+  --green:#16a34a;
+  --green-soft:rgba(22,163,74,.07);
+  --green-border:rgba(22,163,74,.25);
+  --amber:#d97706;
+  --amber-soft:rgba(217,119,6,.07);
+  --amber-border:rgba(217,119,6,.25);
+  --text:#1f2328;
+  --text2:#656d76;
+  --text3:#b1bac4;
+  --shadow:0 0 0 1px rgba(0,0,0,.06),0 4px 24px rgba(0,0,0,.08);
+  --shadow2:0 8px 40px rgba(0,0,0,.12);
+  --input-bg:#ffffff;
+}
+
+/* ── Reset ─────────────────────────────────────────────────────────────── */
+*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+html{scroll-behavior:smooth}
+body{font-family:'Plus Jakarta Sans',sans-serif;background:var(--bg);color:var(--text);min-height:100vh;display:flex;flex-direction:column;align-items:center;padding:0 1rem 6rem;transition:background .3s,color .3s}
+
+/* ── Topbar ─────────────────────────────────────────────────────────────── */
+.topbar{width:100%;max-width:780px;display:flex;align-items:center;justify-content:space-between;padding:1.4rem 0 0}
+.brand{display:flex;align-items:center;gap:.65rem}
+.brand-icon{width:38px;height:38px;border-radius:9px;background:var(--accent);display:flex;align-items:center;justify-content:center;box-shadow:0 2px 10px rgba(59,130,246,.4)}
+.brand-icon i{color:#fff;font-size:.95rem}
+.brand-name{font-size:1rem;font-weight:800;color:var(--text);letter-spacing:-.2px}
+.brand-name em{font-style:normal;color:var(--accent)}
+.brand-sub{font-size:.68rem;color:var(--text2);margin-top:.05rem}
+.theme-btn{display:flex;align-items:center;gap:.38rem;background:var(--surface);border:1px solid var(--border);border-radius:8px;padding:.4rem .75rem;font-size:.76rem;font-weight:600;color:var(--text2);cursor:pointer;transition:all .2s;box-shadow:var(--shadow);font-family:'Plus Jakarta Sans',sans-serif}
+.theme-btn:hover{border-color:var(--accent);color:var(--accent)}
+
+/* ── Hero ───────────────────────────────────────────────────────────────── */
+.wrap{width:100%;max-width:780px}
+.hero{text-align:center;padding:3.5rem 0 2.8rem}
+.hero h1{font-size:2.6rem;font-weight:800;color:var(--text);line-height:1.15;letter-spacing:-.7px}
+.hero h1 span{color:var(--accent)}
+.hero p{color:var(--text2);font-size:.92rem;margin-top:.6rem;line-height:1.6}
+
+/* ── Tabs ───────────────────────────────────────────────────────────────── */
+.tabs{display:flex;gap:.4rem;background:var(--surface2);border:1px solid var(--border);border-radius:12px;padding:.28rem;margin-bottom:1.4rem;box-shadow:var(--shadow)}
+.tab{flex:1;padding:.62rem 1rem;border-radius:9px;border:none;background:transparent;font-family:'Plus Jakarta Sans',sans-serif;font-size:.83rem;font-weight:600;color:var(--text2);cursor:pointer;transition:all .22s;display:flex;align-items:center;justify-content:center;gap:.38rem}
+.tab:hover{color:var(--text)}
+.tab.active{background:var(--surface);color:var(--accent);box-shadow:var(--shadow)}
+.tab-panel{display:none}.tab-panel.active{display:block}
+
+/* ── Card ───────────────────────────────────────────────────────────────── */
+.card{background:var(--surface);border:1px solid var(--border);border-radius:14px;padding:1.7rem 1.9rem;margin-bottom:1.2rem;box-shadow:var(--shadow);transition:border-color .3s,box-shadow .3s}
+.card.c-danger{border-color:var(--red-border);box-shadow:0 0 0 1px var(--red-border),0 4px 24px rgba(239,68,68,.08)}
+.card.c-warning{border-color:var(--amber-border);box-shadow:0 0 0 1px var(--amber-border),0 4px 24px rgba(245,158,11,.08)}
+.card.c-success{border-color:var(--green-border);box-shadow:0 0 0 1px var(--green-border),0 4px 24px rgba(34,197,94,.08)}
+
+/* ── Form elements ──────────────────────────────────────────────────────── */
+.flabel{font-size:.7rem;font-weight:700;color:var(--text3);letter-spacing:.9px;text-transform:uppercase;margin-bottom:.55rem;display:block}
+textarea.field{width:100%;background:var(--input-bg);border:1.5px solid var(--border);border-radius:10px;color:var(--text);font-family:'Plus Jakarta Sans',sans-serif;font-size:.9rem;padding:.9rem 1rem;resize:vertical;outline:none;transition:border-color .2s,box-shadow .2s;line-height:1.65;min-height:160px}
+textarea.field::placeholder{color:var(--text3)}
+textarea.field:focus{border-color:var(--accent);box-shadow:0 0 0 3px var(--accent-soft)}
+
+/* ── Buttons ────────────────────────────────────────────────────────────── */
+.btn-row{display:flex;gap:.7rem;margin-top:1rem}
+.btn-p{flex:1;padding:.8rem;border-radius:10px;border:none;background:var(--accent);color:#fff;font-family:'Plus Jakarta Sans',sans-serif;font-weight:700;font-size:.9rem;cursor:pointer;transition:all .2s;display:flex;align-items:center;justify-content:center;gap:.45rem;letter-spacing:.1px;box-shadow:0 2px 10px rgba(59,130,246,.35)}
+.btn-p:hover{background:var(--accent-h);transform:translateY(-1px);box-shadow:0 4px 18px rgba(59,130,246,.45)}
+.btn-p:active{transform:translateY(0)}
+.btn-s{padding:.8rem 1.25rem;border-radius:10px;border:1.5px solid var(--border);background:transparent;color:var(--text2);font-family:'Plus Jakarta Sans',sans-serif;font-weight:600;font-size:.87rem;cursor:pointer;transition:all .2s;white-space:nowrap}
+.btn-s:hover{border-color:var(--border2);color:var(--text);background:var(--surface2)}
+
+/* ── Upload ─────────────────────────────────────────────────────────────── */
+.dropzone{border:2px dashed var(--border);border-radius:12px;padding:2.2rem 1rem;text-align:center;cursor:pointer;transition:all .22s;background:var(--surface2)}
+.dropzone:hover,.dropzone.over{border-color:var(--accent);background:var(--accent-soft)}
+.dropzone.has-file{border-color:var(--green);border-style:solid;background:var(--green-soft)}
+.dropzone i{font-size:1.8rem;color:var(--text3);margin-bottom:.55rem;display:block;transition:color .2s}
+.dropzone:hover i,.dropzone.over i{color:var(--accent)}
+.dropzone.has-file i{color:var(--green)}
+.dropzone p{color:var(--text2);font-size:.84rem;line-height:1.55}
+.dropzone strong{color:var(--text)}
+#ain{display:none}
+.fchip{display:none;align-items:center;gap:.35rem;background:var(--green-soft);border:1px solid var(--green-border);border-radius:6px;color:var(--green);font-size:.74rem;padding:.22rem .65rem;margin-top:.65rem;width:fit-content;font-weight:600}
+
+/* ── Section label ──────────────────────────────────────────────────────── */
+.div{border:none;border-top:1px solid var(--border);margin:1.2rem 0}
+.slabel{font-size:.68rem;font-weight:700;color:var(--text3);letter-spacing:.9px;text-transform:uppercase;margin-bottom:.48rem;display:flex;align-items:center;gap:.3rem}
+
+/* ── Verdict ────────────────────────────────────────────────────────────── */
+.verdict-wrap{display:flex;align-items:center;gap:1.1rem;padding:.6rem 0 .4rem}
+.verdict-badge{width:58px;height:58px;border-radius:13px;display:flex;align-items:center;justify-content:center;flex-shrink:0;animation:pop .45s cubic-bezier(.36,.07,.19,.97) both}
+.vb-red{background:var(--red-soft);border:1.5px solid var(--red-border)}
+.vb-amb{background:var(--amber-soft);border:1.5px solid var(--amber-border)}
+.vb-grn{background:var(--green-soft);border:1.5px solid var(--green-border)}
+.vb-red i{color:var(--red)}.vb-amb i{color:var(--amber)}.vb-grn i{color:var(--green)}
+.verdict-badge i{font-size:1.55rem}
+@keyframes pop{0%{transform:scale(.25) rotate(-12deg);opacity:0}65%{transform:scale(1.1) rotate(2deg)}100%{transform:scale(1) rotate(0);opacity:1}}
+.verdict-text h3{font-size:1.05rem;font-weight:800;margin-bottom:.18rem;color:var(--text)}
+.risk-row{display:flex;align-items:center;gap:.35rem;font-size:.79rem;color:var(--text2);font-weight:500}
+.rdot{width:7px;height:7px;border-radius:50%;flex-shrink:0}
+
+/* ── Message box ────────────────────────────────────────────────────────── */
+.mbox{background:var(--input-bg);border:1px solid var(--border);border-left:3px solid var(--accent);border-radius:0 9px 9px 0;padding:.75rem 1rem;color:var(--text2);font-size:.84rem;line-height:1.65;word-break:break-word;max-height:110px;overflow-y:auto}
+
+/* ── URL block ──────────────────────────────────────────────────────────── */
+.ublock{border:1px solid var(--border);border-radius:10px;overflow:hidden;margin-top:.48rem}
+.urow{display:flex;align-items:flex-start;gap:.7rem;padding:.7rem .95rem;border-bottom:1px solid var(--border);font-size:.8rem}
+.urow:last-child{border-bottom:none}
+.uvb{font-size:.62rem;font-weight:700;padding:.15rem .48rem;border-radius:20px;white-space:nowrap;flex-shrink:0;margin-top:2px;text-transform:uppercase;letter-spacing:.4px}
+.vbr{background:var(--red-soft);color:var(--red);border:1px solid var(--red-border)}
+.vba{background:var(--amber-soft);color:var(--amber);border:1px solid var(--amber-border)}
+.vbg{background:var(--green-soft);color:var(--green);border:1px solid var(--green-border)}
+.vbc{background:var(--accent-soft);color:var(--accent);border:1px solid var(--accent-border)}
+.utxt{color:var(--text2);word-break:break-all;font-family:monospace;font-size:.76rem;line-height:1.5}
+.ubar{height:3px;border-radius:2px;background:var(--border);margin-top:.35rem;overflow:hidden}
+.ufill{height:100%;border-radius:2px;transition:width 1s ease}
+.uflag{font-size:.71rem;color:var(--text3);display:flex;align-items:center;gap:.25rem;margin-top:.12rem;line-height:1.4}
+
+/* ── Tags ───────────────────────────────────────────────────────────────── */
+.tagr{display:inline-flex;align-items:center;gap:.25rem;background:var(--red-soft);border:1px solid var(--red-border);border-radius:20px;color:var(--red);font-size:.73rem;font-weight:600;padding:.2rem .68rem;margin:.1rem}
+.tags{background:var(--green-soft);border-color:var(--green-border);color:var(--green)}
+.kw{display:inline-block;background:var(--accent-soft);border:1px solid var(--accent-border);border-radius:6px;color:var(--accent);font-size:.71rem;font-weight:600;padding:.16rem .48rem;margin:.1rem;letter-spacing:.1px}
+
+/* ── SHAP Chart ────────────────────────────────────────────────────────── */
+.shap-chart { display: flex; flex-direction: column; gap: 0.5rem; margin-top: 0.8rem; font-size: 0.75rem; }
+.shap-row { display: flex; align-items: center; gap: 0.5rem; }
+.shap-word { width: 90px; text-align: right; font-weight: 600; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; color: var(--text2); }
+.shap-bar-container { flex: 1; position: relative; height: 16px; border-left: none; }
+.shap-bar-container::before { content: ''; position: absolute; left: 50%; top: -2px; bottom: -2px; width: 1px; background: var(--border); z-index: 1; }
+.shap-val { width: 50px; font-size: 0.7rem; color: var(--text3); text-align: left; }
+
+/* ── Progress ───────────────────────────────────────────────────────────── */
+.prow{display:flex;justify-content:space-between;align-items:baseline;margin-bottom:.45rem}
+.plbl{font-size:.79rem;font-weight:600;color:var(--text2)}
+.ppct{font-size:1.15rem;font-weight:800;color:var(--text);font-variant-numeric:tabular-nums}
+.ptrack{height:9px;border-radius:5px;background:var(--surface2);border:1px solid var(--border);overflow:hidden}
+.pfill{height:100%;border-radius:5px;width:0%;transition:width 1.5s cubic-bezier(.23,1,.32,1);position:relative;overflow:hidden}
+.pfill::after{content:'';position:absolute;inset:0;background:linear-gradient(90deg,transparent,rgba(255,255,255,.18),transparent);animation:sh 2.2s infinite}
+@keyframes sh{0%{transform:translateX(-100%)}100%{transform:translateX(100%)}}
+.pticks{display:flex;justify-content:space-between;margin-top:.28rem;font-size:.66rem;color:var(--text3)}
+
+/* ── Alert box ──────────────────────────────────────────────────────────── */
+.abox{border-radius:10px;padding:.95rem 1.05rem;display:flex;gap:.8rem;align-items:flex-start;margin-top:1.1rem}
+.a-red{background:var(--red-soft);border:1px solid var(--red-border)}
+.a-inf{background:var(--accent-soft);border:1px solid var(--accent-border)}
+.a-ico{font-size:1rem;flex-shrink:0;margin-top:.1rem}
+.a-red .a-ico{color:var(--red)}.a-inf .a-ico{color:var(--accent)}
+.a-title{font-size:.84rem;font-weight:700;margin-bottom:.28rem}
+.a-red .a-title{color:var(--red)}.a-inf .a-title{color:var(--accent)}
+.a-body{font-size:.79rem;line-height:1.7;color:var(--text2)}
+.a-body strong{color:var(--text)}
+.a-body code{background:var(--surface2);border:1px solid var(--border);border-radius:4px;padding:.04rem .32rem;font-family:monospace;font-size:.76rem;color:var(--text)}
+
+/* ── Transcript ─────────────────────────────────────────────────────────── */
+.tbox{background:var(--input-bg);border:1px solid var(--border);border-left:3px solid var(--accent);border-radius:0 9px 9px 0;padding:.78rem 1rem;font-size:.83rem;line-height:1.7;color:var(--text2);max-height:140px;overflow-y:auto;word-break:break-word}
+.tchips{display:flex;gap:.4rem;flex-wrap:wrap;margin-top:.55rem}
+.tch{background:var(--accent-soft);border:1px solid var(--accent-border);border-radius:20px;color:var(--accent);font-size:.7rem;padding:.16rem .5rem;font-weight:600;display:inline-flex;align-items:center;gap:.25rem}
+
+/* ── Error ──────────────────────────────────────────────────────────────── */
+.err{border-radius:9px;padding:.65rem .95rem;font-size:.8rem;margin-bottom:1rem;display:flex;align-items:center;gap:.5rem;background:var(--red-soft);border:1px solid var(--red-border);color:var(--red);font-weight:500}
+
+/* ── Overlay ────────────────────────────────────────────────────────────── */
+#ov{display:none;position:fixed;inset:0;z-index:9999;flex-direction:column;align-items:center;justify-content:center;gap:.9rem;backdrop-filter:blur(6px)}
+[data-theme="dark"] #ov{background:rgba(13,17,23,.88)}
+[data-theme="light"] #ov{background:rgba(246,248,250,.88)}
+#ov.on{display:flex}
+.spin{width:44px;height:44px;border:3px solid var(--border);border-top-color:var(--accent);border-radius:50%;animation:spin .75s linear infinite}
+@keyframes spin{to{transform:rotate(360deg)}}
+#ov p{color:var(--text2);font-size:.88rem;font-weight:500}
+
+/* ── Animations ─────────────────────────────────────────────────────────── */
+.rc{animation:rise .42s cubic-bezier(.16,1,.3,1) both}
+@keyframes rise{from{opacity:0;transform:translateY(16px)}to{opacity:1;transform:translateY(0)}}
+
+/* ── Responsive ─────────────────────────────────────────────────────────── */
+@media(max-width:600px){
+  .card{padding:1.3rem 1.1rem}
+  .hero h1{font-size:1.9rem}
+  .btn-row{flex-direction:column}
+  .btn-s{width:100%;text-align:center}
+  .verdict-wrap{flex-direction:column;text-align:center}
+}
+</style>
+</head>
+<body>
+
+<!-- Loading overlay -->
+<div id="ov"><div class="spin"></div><p id="ovm">Analysing threat…</p></div>
+
+<!-- Topbar -->
+<div class="topbar">
+  <div class="brand">
+    <div class="brand-icon"><i class="fa-solid fa-shield-halved"></i></div>
+    <div>
+      <div class="brand-name">Scam<em>Shield</em> AI</div>
+      <div class="brand-sub">Threat Detection System</div>
+    </div>
+  </div>
+  <button class="theme-btn" onclick="tg()" id="tbtn">
+    <span id="ticon">☀️</span><span id="ttext">Light Mode</span>
+  </button>
+</div>
+
+<div class="wrap">
+
+  <!-- Hero -->
+  <div class="hero">
+    <h1>Detect <span>Scams</span><br/>Before They Strike</h1>
+    <p>AI-powered analysis of messages, links and phone calls.</p>
+  </div>
+
+  <!-- Tabs -->
+  <div class="tabs">
+    <button class="tab active" onclick="sw('text')" id="tab-text">
+      <i class="fa-solid fa-magnifying-glass" style="font-size:11px"></i> Text &amp; Link Scanner
+    </button>
+    <button class="tab" onclick="sw('audio')" id="tab-audio">
+      <i class="fa-solid fa-microphone-lines" style="font-size:11px"></i> Call Audio Analyser
+    </button>
+  </div>
+
+  <!-- ── TEXT TAB ── -->
+  <div class="tab-panel active" id="panel-text">
+    <div class="card">
+      <span class="flabel">Paste message, SMS, email or URL</span>
+      <textarea class="field" id="mi" rows="6"
+        placeholder="Paste any suspicious content here…&#10;Press Ctrl+Enter to scan."></textarea>
+      <div class="btn-row">
+        <button class="btn-p" onclick="rT()">
+          <i class="fa-solid fa-shield-halved" style="font-size:13px"></i> Run Threat Analysis
+        </button>
+        <button class="btn-s" onclick="cT()">
+          <i class="fa-solid fa-xmark" style="font-size:12px"></i> Clear
+        </button>
+      </div>
+    </div>
+
+    <div id="terr" class="err" style="display:none">
+      <i class="fa-solid fa-circle-xmark" style="font-size:12px;flex-shrink:0"></i>
+      <span id="terrm"></span>
+    </div>
+
+    <div id="tout" style="display:none" class="rc">
+      <div class="card" id="tcard">
+
+        <!-- Verdict -->
+        <div class="verdict-wrap">
+          <div class="verdict-badge vb-red" id="tvb">
+            <i id="tico" class="fa-solid fa-triangle-exclamation"></i>
+          </div>
+          <div class="verdict-text">
+            <h3 id="tverdict">Threat Detected</h3>
+            <div class="risk-row">
+              <span class="rdot" id="trdot" style="background:var(--red)"></span>
+              <span id="tlvl">High Risk</span>
+            </div>
+          </div>
+        </div>
+
+        <div class="div"></div>
+
+        <!-- Scanned message -->
+        <div style="margin-bottom:1.1rem">
+          <div class="slabel">
+            <i class="fa-solid fa-envelope-open" style="font-size:9px"></i> Scanned input
+          </div>
+          <div class="mbox" id="tmsg"></div>
+        </div>
+
+        <!-- URL results -->
+        <div id="turw" style="display:none;margin-bottom:1.1rem">
+          <div class="slabel">
+            <i class="fa-solid fa-link" style="font-size:9px"></i>
+            URL analysis — <span id="turc">0</span> link(s) found
+          </div>
+          <div class="ublock" id="turl"></div>
+        </div>
+
+        <!-- Threat category -->
+        <div style="margin-bottom:1.1rem">
+          <div class="slabel">
+            <i class="fa-solid fa-tags" style="font-size:9px"></i> Threat category
+          </div>
+          <div id="ttyp"></div>
+        </div>
+
+        <!-- Keywords -->
+        <div id="tkww" style="display:none;margin-bottom:1.1rem">
+          <div class="slabel">
+            <i class="fa-solid fa-key" style="font-size:9px"></i> Trigger keywords detected
+          </div>
+          <div id="tkws"></div>
+        </div>
+
+        <!-- SHAP Explainability -->
+        <div id="tshap" style="display:none;margin-bottom:1.1rem">
+          <div class="slabel"><i class="fa-solid fa-chart-bar" style="font-size:9px"></i> SHAP Explainability (Word Impact)</div>
+          <div class="shap-chart" id="shap-container"></div>
+        </div>
+
+        <div class="div"></div>
+
+        <!-- Confidence bar -->
+        <div>
+          <div class="prow">
+            <span class="plbl">Threat confidence score</span>
+            <span class="ppct" id="tpct">0%</span>
+          </div>
+          <div class="ptrack"><div class="pfill" id="tbar"></div></div>
+          <div class="pticks">
+            <span>Safe · 0%</span><span>Medium · 50%</span><span>High · 75%+</span>
+          </div>
+        </div>
+
+        <!-- Warning -->
+        <div id="talert" style="display:none" class="abox a-red">
+          <i class="fa-solid fa-bell a-ico"></i>
+          <div>
+            <div class="a-title">Early Warning — Immediate Action Required</div>
+            <div class="a-body">
+              Do <strong>NOT</strong> click any links or share your OTP, Aadhaar, or bank details.<br/>
+              This matches patterns of <strong>Digital Arrest</strong>, <strong>Phishing</strong> &amp; <strong>Financial Fraud</strong>.<br/><br/>
+              ▸ Block the sender immediately<br/>
+              ▸ Report at <code>cybercrime.gov.in</code><br/>
+              ▸ National Helpline: <code>1930</code>
+            </div>
+          </div>
+        </div>
+
+        <div style="text-align:center;margin-top:1.3rem">
+          <button class="btn-s" onclick="cT()">
+            <i class="fa-solid fa-rotate-left" style="font-size:11px"></i> Scan Another
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <!-- ── AUDIO TAB ── -->
+  <div class="tab-panel" id="panel-audio">
+    <div class="card">
+      <span class="flabel">Upload call recording</span>
+      <div class="dropzone" id="dz" onclick="document.getElementById('ain').click()">
+        <i class="fa-solid fa-cloud-arrow-up"></i>
+        <p><strong>Click to upload</strong> or drag &amp; drop here</p>
+        <p style="margin-top:.28rem;font-size:.74rem;color:var(--text3)">
+          WAV &middot; MP3 &middot; OGG &middot; FLAC &middot; M4A &mdash; Max 50 MB
+        </p>
+      </div>
+      <div class="fchip" id="fch">
+        <i class="fa-solid fa-file-audio" style="font-size:10px"></i>
+        <span id="fn"></span>
+      </div>
+      <input type="file" id="ain" accept=".wav,.mp3,.ogg,.flac,.m4a,.aac"/>
+      <div class="btn-row" style="margin-top:.9rem">
+        <button class="btn-p" onclick="rA()">
+          <i class="fa-solid fa-waveform-lines" style="font-size:13px"></i> Analyse Call Recording
+        </button>
+      </div>
+      <div class="abox a-inf" style="margin-top:1rem">
+        <i class="fa-solid fa-circle-info a-ico"></i>
+        <div>
+          <div class="a-title">How audio analysis works</div>
+          <div class="a-body">
+            Upload a recorded call → AI transcribes speech to text → Scam model analyses
+            the transcript → Risk verdict returned. Connect to Flask backend for real transcription.
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <div id="aerr" class="err" style="display:none">
+      <i class="fa-solid fa-circle-xmark" style="font-size:12px;flex-shrink:0"></i>
+      <span id="aerrm"></span>
+    </div>
+
+    <div id="aout" style="display:none" class="rc">
+      <div class="card">
+
+        <!-- Transcript -->
+        <div style="margin-bottom:1.1rem">
+          <div class="slabel">
+            <i class="fa-solid fa-waveform-lines" style="font-size:9px;color:var(--accent)"></i> Call transcript
+          </div>
+          <div class="tbox" id="atx"></div>
+          <div class="tchips">
+            <span class="tch"><i class="fa-solid fa-clock" style="font-size:9px"></i> <span id="adur"></span></span>
+            <span class="tch"><i class="fa-solid fa-align-left" style="font-size:9px"></i> <span id="awrd"></span></span>
+            <span class="tch"><i class="fa-solid fa-microchip" style="font-size:9px"></i> Google STT</span>
+          </div>
+        </div>
+
+        <div class="div"></div>
+
+        <!-- Verdict -->
+        <div class="verdict-wrap">
+          <div class="verdict-badge vb-red" id="avb">
+            <i id="aico" class="fa-solid fa-triangle-exclamation"></i>
+          </div>
+          <div class="verdict-text">
+            <h3 id="averdict">Scam Call Detected</h3>
+            <div class="risk-row">
+              <span class="rdot" id="ardot" style="background:var(--red)"></span>
+              <span id="alvl">High Risk</span>
+            </div>
+          </div>
+        </div>
+
+        <div class="div"></div>
+
+        <div style="margin-bottom:1.1rem">
+          <div class="slabel"><i class="fa-solid fa-tags" style="font-size:9px"></i> Threat category</div>
+          <div id="atyp"></div>
+        </div>
+
+        <div id="akww" style="display:none;margin-bottom:1.1rem">
+          <div class="slabel"><i class="fa-solid fa-key" style="font-size:9px"></i> Suspicious phrases in call</div>
+          <div id="akws"></div>
+        </div>
+
+        <div class="div"></div>
+
+        <div>
+          <div class="prow">
+            <span class="plbl">Threat confidence score</span>
+            <span class="ppct" id="apct">0%</span>
+          </div>
+          <div class="ptrack"><div class="pfill" id="abar"></div></div>
+          <div class="pticks">
+            <span>Safe · 0%</span><span>Medium · 50%</span><span>High · 75%+</span>
+          </div>
+        </div>
+
+        <div id="aalert" style="display:none" class="abox a-red">
+          <i class="fa-solid fa-phone-slash a-ico"></i>
+          <div>
+            <div class="a-title">Scam Call — Hang Up Immediately</div>
+            <div class="a-body">
+              Do <strong>NOT</strong> share personal, financial or identity information.<br/><br/>
+              ▸ Block the caller number<br/>
+              ▸ Report at <code>cybercrime.gov.in</code><br/>
+              ▸ National Helpline: <code>1930</code>
+            </div>
+          </div>
+        </div>
+
+        <div style="text-align:center;margin-top:1.3rem">
+          <button class="btn-s" onclick="cA()">
+            <i class="fa-solid fa-rotate-left" style="font-size:11px"></i> Analyse Another
+          </button>
+        </div>
+      </div>
+    </div>
+  </div>
+
+</div><!-- /wrap -->
+
+<script>
+/* ── Theme toggle ─────────────────────────────────────────────────────── */
+function tg(){
+  const h=document.documentElement;
+  const cur=h.getAttribute('data-theme');
+  const nxt=cur==='dark'?'light':'dark';
+  h.setAttribute('data-theme',nxt);
+  document.getElementById('ticon').textContent=nxt==='dark'?'☀️':'🌙';
+  document.getElementById('ttext').textContent=nxt==='dark'?'Light Mode':'Dark Mode';
+}
+
+/* ── Tab switch ───────────────────────────────────────────────────────── */
+function sw(t){
+  document.querySelectorAll('.tab').forEach(e=>e.classList.remove('active'));
+  document.querySelectorAll('.tab-panel').forEach(e=>e.classList.remove('active'));
+  document.getElementById('tab-'+t).classList.add('active');
+  document.getElementById('panel-'+t).classList.add('active');
+}
+
+/* ── Detection data ───────────────────────────────────────────────────── */
+const SCAM_TYPES={
+  'KYC / Bank Fraud':['kyc','aadhaar','upi','neft','account blocked','account suspended','bank account','share otp','send otp'],
+  'Lottery / Prize Scam':['prize','winner','lottery','lucky draw','won','congratulations','cash prize','jackpot','claim prize'],
+  'Digital Arrest Scam':['arrest','cbi','police','court','warrant','cybercrime','money laundering','digital arrest','fbi','irs','legal action'],
+  'OTP / Phishing':['otp','bit.ly','tinyurl','click here','verify now','password reset','login credentials'],
+  'Job / Loan Scam':['job offer','loan approved','registration fee','processing fee','earn daily','work from home'],
+  'Government Scheme':['pm scheme','free subsidy','ration card','pension','pm kisan','free laptop'],
+  'Tax Authority Scam':['income tax','tax refund','unpaid tax','tax fraud','hmrc','ato','tax warrant'],
+  'Social Security Scam':['social security','medicare','ssn suspended','benefits suspended','national insurance'],
+  'Crypto / Investment':['bitcoin','cryptocurrency','crypto wallet','guaranteed returns','trading profit'],
+  'Advance Fee / Romance':['western union','wire transfer','moneygram','gold transfer','inheritance fund'],
+};
+const ALL_KW=['otp','aadhaar','kyc','upi','neft','arrest','cbi','warrant','prize','winner',
+  'lottery','lucky draw','suspended','blocked','immediately','urgent','click here','verify now',
+  'share your','bitcoin','cryptocurrency','wire transfer','western union','irs','hmrc',
+  'social security','medicare','tax refund','illegal','fraud','cybercrime','bank details',
+  'police','court','password','jackpot','claim'];
+const URGENCY=['urgent','immediately','expire','blocked','suspended','arrested','action required','now','today'];
+const THREAT=['arrest','warrant','police','cbi','fbi','irs','court','legal action','cybercrime','illegal','fraud','jail'];
+const PRIZE=['won','winner','prize','lottery','lucky draw','congratulations','jackpot','claim'];
+const FIN=['otp','pin','bank account','upi','neft','wire transfer','bitcoin','kyc','aadhaar','password'];
+const SHORT=['bit.ly','tinyurl.com','goo.gl','ow.ly','t.co','tiny.cc','is.gd','buff.ly','adf.ly'];
+const WL=['sbi.co.in','hdfcbank.com','icicibank.com','axisbank.com','paytm.com','phonepe.com',
+  'airtel.in','i.airtel.in','myairtel.in','jio.com','vi.in','bsnl.co.in','gov.in','nic.in',
+  'uidai.gov.in','incometax.gov.in','rbi.org.in','irctc.co.in','amazon.in','amazon.com',
+  'flipkart.com','zomato.com','swiggy.com','google.com','youtube.com','apple.com',
+  'microsoft.com','netflix.com','paypal.com','chase.com','bankofamerica.com','barclays.co.uk',
+  'hsbc.com','natwest.com','hmrc.gov.uk','ato.gov.au','hotstar.com','primevideo.com'];
+const BRANDS=['sbi','hdfc','icici','axis','paytm','phonepe','amazon','flipkart','google',
+  'paypal','apple','microsoft','netflix','whatsapp','airtel','jio','bank','chase',
+  'wellsfargo','citibank','barclays','irs','hmrc'];
+const STLDS=new Set(['xyz','top','club','online','site','website','space','tk','ml','ga',
+  'cf','gq','pw','cc','icu','buzz','fun','loan','win','bid','biz']);
+const DEMOS=[
+  'This is officer Johnson from the IRS. Your social security number has been suspended due to suspicious activity. You owe 3200 dollars in back taxes. Call us immediately or you will be arrested today.',
+  'Hello this is Amazon customer service. Your account has been compromised. Please share your OTP and credit card details with our agent now to secure it.',
+  'Congratulations you have been selected as lucky draw winner. You won one lakh rupees. Share your bank account number and Aadhaar number immediately to claim your prize.',
+  'This is a CBI officer. Your Aadhaar is linked to 12 illegal bank accounts. You are under digital arrest. Do not tell anyone or the police will come to your home within one hour.',
+  'I am calling from Paytm KYC department. Your KYC is still pending. If not done within 2 hours your UPI account will be permanently blocked. Please share your OTP now to verify.',
+];
+
+/* ── URL extractor & analyser ─────────────────────────────────────────── */
+function xU(t){
+  const re=/(?:https?:\/\/|www\.)[^\s\)\]\,\"\'<>]+|[a-zA-Z0-9\-]+\.(?:com|in|org|net|co\.in|gov\.in|edu|xyz|top|club|online|site|tk|ml|ga|cf|biz|info|pw|cc|icu|buzz|fun|loan)[^\s]*/gi;
+  return[...new Set((t.match(re)||[]).map(u=>u.replace(/[.,;:!?"\')}\]]+$/,'')))];
+}
+
+async function checkDomainLegitimacy(domain) {
+  try {
+    const response = await fetch('/check-domain', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ domain: domain })
+    });
+    const data = await response.json();
+    return data.is_legitimate || false;
+  } catch (e) {
+    console.error('Domain check failed:', e);
+    return false;
+  }
+}
+
+async function aU(url){
+  const n=url.startsWith('http')?url:'http://'+url;
+  let r=0; const f=[];
+  const hm=n.match(/\/\/([^\/\?#]+)/);
+  const h=(hm?hm[1]:'').toLowerCase();
+  const pts=h.split('.');
+  const tld=pts[pts.length-1];
+  
+  // CHECK GOOGLE SAFE BROWSING FIRST - This is the primary classifier
+  const isLegit = await checkDomainLegitimacy(h);
+  
+  if(isLegit) {
+    // Domain is verified safe by Google
+    return{url,r:0,v:'Verified Safe',vc:'g',f:['✓ Verified by Google Safe Browsing API']};
+  }
+  
+  // Domain is NOT verified safe - could be malicious or unknown
+  // Check if it's a known shortener or IP address (high risk indicators)
+  if(SHORT.some(s=>h===s||h.endsWith('.'+s))){
+    f.push('URL shortener — hides real destination');r+=60;
+  }
+  if(/^(\d{1,3}\.){3}\d{1,3}$/.test(h)){
+    f.push('IP address used instead of domain name');r+=70;
+  }
+  
+  // If shortener or IP, mark as high threat
+  if(r>=60) {
+    r=Math.min(r,100);
+    const vc='r';
+    const v='High Threat';
+    return{url,r,v,vc,f};
+  }
+  
+  // For other unknown domains, apply additional heuristics
+  if(STLDS.has(tld)){f.push('Suspicious TLD: .'+tld);r+=40;}
+  const sc=pts.length-2;
+  if(sc>=3){f.push('Excessive subdomains ('+sc+')');r+=25;}
+  else if(sc===2){f.push('Multiple subdomains detected');r+=12;}
+  
+  for(const b of BRANDS){
+    if(h.includes(b)){
+      f.push('Brand impersonation: "'+b+'" in domain');r+=60;break;
+    }
+  }
+  
+  const pk=['login','verify','secure','confirm','kyc','otp','aadhaar','prize','winner',
+    'claim','suspend','block','expire','urgent','click','update','account'];
+  const hits=pk.filter(k=>n.toLowerCase().includes(k));
+  if(hits.length>=3){f.push('Phishing keywords: '+hits.slice(0,3).join(', '));r+=40;}
+  else if(hits.length>0){f.push('Phishing keyword: '+hits[0]);r+=20;}
+  
+  if(!n.startsWith('https')){f.push('No HTTPS — unencrypted connection');r+=15;}
+  if(url.length>120){f.push('Unusually long URL');r+=10;}
+  
+  r=Math.min(r,100);
+  
+  // If no red flags found, treat as suspicious (unknown domain)
+  if(!f.length){
+    f.push('Unknown domain — not verified by Google Safe Browsing');
+    r=Math.max(r, 50);  // At least medium risk for unknown
+  }
+  
+  const vc=r>=70?'r':r>=40?'a':r>=1?'c':'g';
+  const v=r>=70?'High Threat':r>=40?'Suspicious':r>=1?'Low Risk':'Safe';
+  return{url,r,v,vc,f};
+}
+
+/* ── Scoring & detection ──────────────────────────────────────────────── */
+function dTypes(t){
+  const tl=t.toLowerCase();
+  return Object.entries(SCAM_TYPES)
+    .filter(([,kws])=>kws.filter(k=>tl.includes(k)).length>=2)
+    .map(([ty])=>ty).slice(0,4);
+}
+function dKws(t){
+  const tl=t.toLowerCase();
+  return ALL_KW.filter(k=>tl.includes(k)).slice(0,10);
+}
+function score(t){
+  const tl=t.toLowerCase(); const w=t.split(/\s+/).length; let s=0;
+  s+=Math.min(URGENCY.filter(k=>tl.includes(k)).length*8,28);
+  s+=Math.min(THREAT.filter(k=>tl.includes(k)).length*12,40);
+  s+=Math.min(PRIZE.filter(k=>tl.includes(k)).length*10,28);
+  s+=Math.min(FIN.filter(k=>tl.includes(k)).length*9,30);
+  if(/https?:|www\.|bit\.ly|tinyurl/.test(tl))s+=12;
+  if(/\botp\b/.test(tl))s+=14;
+  if(/\barrest\b|\bwarrant\b/.test(tl))s+=18;
+  if(t.split('!').length>2)s+=4;
+  if(w<5)s=Math.max(s-16,0);
+  return Math.min(Math.round(s),99);
+}
+function getRisk(p){
+  if(p>75)return{lv:'High Risk',ii:'fa-solid fa-triangle-exclamation',ic:'var(--red)',vbc:'vb-red',bc:'var(--red)',dot:'var(--red)',cls:'c-danger',w:true};
+  if(p>50)return{lv:'Medium Risk',ii:'fa-solid fa-circle-exclamation',ic:'var(--amber)',vbc:'vb-amb',bc:'var(--amber)',dot:'var(--amber)',cls:'c-warning',w:false};
+  return{lv:'Low Risk',ii:'fa-solid fa-circle-check',ic:'var(--green)',vbc:'vb-grn',bc:'var(--green)',dot:'var(--green)',cls:'c-success',w:false};
+}
+
+/* ── Render helpers ───────────────────────────────────────────────────── */
+function rTypes(types,id){
+  const el=document.getElementById(id);
+  if(!types.length){el.innerHTML='<span class="tagr tags"><i class="fa-solid fa-circle-check" style="font-size:9px;margin-right:.2rem"></i>No known threat category</span>';return;}
+  el.innerHTML=types.map(t=>'<span class="tagr"><i class="fa-solid fa-triangle-exclamation" style="font-size:9px;margin-right:.22rem"></i>'+t+'</span>').join('');
+}
+function rKws(kws,wid,lid){
+  const w=document.getElementById(wid),l=document.getElementById(lid);
+  if(!kws.length){w.style.display='none';return;}
+  w.style.display='block';
+  l.innerHTML=kws.map(k=>'<span class="kw">'+k+'</span>').join('');
+}
+function rBar(id,p,c){
+  const b=document.getElementById(id);
+  b.style.background=c; b.style.width='0%';
+  setTimeout(()=>b.style.width=p+'%',200);
+}
+function rUrls(us,wid,cid,lid){
+  const w=document.getElementById(wid);
+  if(!us.length){w.style.display='none';return;}
+  w.style.display='block';
+  document.getElementById(cid).textContent=us.length;
+  const l=document.getElementById(lid);
+  const cm={'r':'vbr','a':'vba','g':'vbg','c':'vbc'};
+  const col={'r':'var(--red)','a':'var(--amber)','g':'var(--green)','c':'var(--accent)'};
+  l.innerHTML=us.map((r,i)=>`
+    <div class="urow">
+      <span class="uvb ${cm[r.vc]}">${r.v}</span>
+      <div style="flex:1;min-width:0">
+        <div class="utxt">${r.url}</div>
+        <div class="ubar"><div class="ufill" id="uf${i}" style="width:0%;background:${col[r.vc]}"></div></div>
+        <div>${r.f.map(x=>'<div class="uflag"><i class="fa-solid fa-caret-right" style="font-size:7px;color:var(--text3)"></i> '+x+'</div>').join('')}</div>
+      </div>
+    </div>`).join('');
+  setTimeout(()=>us.forEach((r,i)=>{const el=document.getElementById('uf'+i);if(el)el.style.width=r.r+'%';}),380);
+}
+
+function renderShap(words) {
+  const container = document.getElementById('shap-container');
+  if (!words || !words.length) {
+     container.innerHTML = '<i>No explanation available</i>';
+     return;
+  }
+  
+  words.sort((a, b) => Math.abs(b[1]) - Math.abs(a[1]));
+  const maxVal = Math.max(...words.map(w => Math.abs(w[1])));
+  
+  let html = '';
+  words.slice(0, 10).forEach(w => {
+    const word = w[0];
+    const val = w[1];
+    const pct = (Math.abs(val) / maxVal) * 45; 
+    const isSpam = val > 0;
+    
+    let barStyle = '';
+    if (isSpam) {
+      barStyle = `left: 50%; width: ${pct}%; background: var(--red);`;
+    } else {
+      barStyle = `right: 50%; width: ${pct}%; background: var(--green);`;
+    }
+    
+    html += `
+      <div class="shap-row">
+        <div class="shap-word">${word}</div>
+        <div class="shap-bar-container">
+          <div style="position: absolute; height: 10px; border-radius: 2px; top: 3px; ${barStyle}"></div>
+        </div>
+        <div class="shap-val">${val > 0 ? '+' : ''}${val.toFixed(3)}</div>
+      </div>
+    `;
+  });
+  
+  container.innerHTML = html;
+  document.getElementById('tshap').style.display = 'block';
+}
+
+/* ── Text scan ────────────────────────────────────────────────────────── */
+function rT(){
+  const msg=document.getElementById('mi').value.trim();
+  document.getElementById('terr').style.display='none';
+  if(!msg){document.getElementById('terr').style.display='flex';document.getElementById('terrm').textContent='Please enter a message or URL to analyse.';return;}
+  const ov=document.getElementById('ov');
+  document.getElementById('ovm').textContent='Running threat analysis…';
+  ov.classList.add('on');
+  document.getElementById('tshap').style.display = 'none';
+
+  fetch('/predict', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ message: msg })
+  })
+  .then(res => res.json())
+   .then(data => {
+     if(data.error) {
+        ov.classList.remove('on');
+        document.getElementById('terr').style.display='flex';
+        document.getElementById('terrm').textContent=data.error;
+        return;
+     }
+     
+     let p = Math.round(data.confidence * 100);
+     p = Math.min(Math.max(p, 0), 99);
+     const rk = getRisk(p);
+     
+     // Update UI with text and model results first
+     const tvb=document.getElementById('tvb');
+     tvb.className='verdict-badge '+rk.vbc;
+     document.getElementById('tico').className=rk.ii;
+     document.getElementById('tverdict').textContent=data.label === 'spam' ? 'Threat Detected' : 'Appears Legitimate';
+     document.getElementById('tlvl').textContent=rk.lv;
+     document.getElementById('trdot').style.background=rk.dot;
+     document.getElementById('tmsg').textContent=msg;
+     document.getElementById('tpct').textContent=p+'%';
+     rBar('tbar',p,rk.bc);
+     document.getElementById('talert').style.display=rk.w?'flex':'none';
+     document.getElementById('tcard').className='card '+rk.cls;
+     document.getElementById('tout').style.display='block';
+     document.getElementById('tout').scrollIntoView({behavior:'smooth',block:'start'});
+     
+     // Now analyze URLs asynchronously
+     const urlList = xU(msg);
+     const ty = dTypes(msg);
+     const kw = dKws(msg);
+     
+     rTypes(ty,'ttyp');
+     rKws(kw,'tkww','tkws');
+     
+     // Analyze each URL with Safe Browsing API
+     Promise.all(urlList.map(aU))
+       .then(us => {
+         rUrls(us,'turw','turc','turl');
+         
+         // Now fetch explainability
+         document.getElementById('ovm').textContent='Generating explainability…';
+         fetch('/explain', {
+             method: 'POST',
+             headers: { 'Content-Type': 'application/json' },
+             body: JSON.stringify({ message: msg })
+         })
+         .then(r => r.json())
+         .then(exData => {
+             ov.classList.remove('on');
+             if(!exData.error) {
+                 renderShap([...(exData.top_spam_words||[]), ...(exData.top_ham_words||[])]);
+             }
+         }).catch(e => {
+             console.error("SHAP error:", e);
+             ov.classList.remove('on');
+         });
+       })
+       .catch(err => {
+         console.error("URL analysis error:", err);
+         rUrls([],'turw','turc','turl');
+         ov.classList.remove('on');
+       });
+     
+   })
+  .catch(err => {
+    ov.classList.remove('on');
+    document.getElementById('terr').style.display='flex';
+    document.getElementById('terrm').textContent='Failed to connect to backend: ' + err;
+  });
+}
+
+/* ── Audio scan ───────────────────────────────────────────────────────── */
+function rA(){
+  const fi=document.getElementById('ain');
+  document.getElementById('aerr').style.display='none';
+  if(!fi.files||!fi.files.length){
+    document.getElementById('aerr').style.display='flex';
+    document.getElementById('aerrm').textContent='Please select a call recording file to analyse.';
+    return;
+  }
+  const f=fi.files[0];
+  const ov=document.getElementById('ov');
+  document.getElementById('ovm').textContent='Transcribing + analysing call…';
+  ov.classList.add('on');
+  setTimeout(()=>{
+    ov.classList.remove('on');
+    const tx=DEMOS[Math.floor(Math.random()*DEMOS.length)];
+    const wd=tx.split(' ').length;
+    const dr=Math.max(Math.round(f.size/16000),8);
+    document.getElementById('atx').textContent=tx;
+    document.getElementById('adur').textContent=dr+'s';
+    document.getElementById('awrd').textContent=wd+' words';
+    let p=score(tx); p=Math.min(p,99);
+    const rk=getRisk(p);
+    const ty=dTypes(tx);
+    const kw=dKws(tx);
+    const avb=document.getElementById('avb');
+    avb.className='verdict-badge '+rk.vbc;
+    document.getElementById('aico').className=rk.ii;
+    document.getElementById('averdict').textContent=p>50?'Scam Call Detected':'Call Appears Safe';
+    document.getElementById('alvl').textContent=rk.lv;
+    document.getElementById('ardot').style.background=rk.dot;
+    document.getElementById('apct').textContent=p+'%';
+    rBar('abar',p,rk.bc);
+    rTypes(ty,'atyp');
+    rKws(kw,'akww','akws');
+    document.getElementById('aalert').style.display=rk.w?'flex':'none';
+    document.getElementById('aout').style.display='block';
+    document.getElementById('aout').scrollIntoView({behavior:'smooth',block:'start'});
+  },2000);
+}
+
+/* ── Clear ────────────────────────────────────────────────────────────── */
+function cT(){
+  document.getElementById('mi').value='';
+  document.getElementById('tout').style.display='none';
+  document.getElementById('terr').style.display='none';
+  document.getElementById('tbar').style.width='0%';
+  window.scrollTo({top:0,behavior:'smooth'});
+}
+function cA(){
+  document.getElementById('ain').value='';
+  document.getElementById('fch').style.display='none';
+  document.getElementById('dz').classList.remove('has-file');
+  document.getElementById('aout').style.display='none';
+  document.getElementById('aerr').style.display='none';
+  document.getElementById('abar').style.width='0%';
+}
+
+/* ── File upload UX ───────────────────────────────────────────────────── */
+document.addEventListener('DOMContentLoaded',()=>{
+  const ai=document.getElementById('ain');
+  const dz=document.getElementById('dz');
+  const fc=document.getElementById('fch');
+  const fn=document.getElementById('fn');
+  ai.addEventListener('change',()=>{
+    if(ai.files.length){
+      const f=ai.files[0];
+      fn.textContent=f.name+' ('+(f.size/1024/1024).toFixed(2)+' MB)';
+      fc.style.display='inline-flex';
+      dz.classList.add('has-file');
+    }
+  });
+  dz.addEventListener('dragover',e=>{e.preventDefault();dz.classList.add('over');});
+  dz.addEventListener('dragleave',()=>dz.classList.remove('over'));
+  dz.addEventListener('drop',e=>{
+    e.preventDefault();dz.classList.remove('over');
+    if(e.dataTransfer.files.length){
+      ai.files=e.dataTransfer.files;
+      const f=e.dataTransfer.files[0];
+      fn.textContent=f.name+' ('+(f.size/1024/1024).toFixed(2)+' MB)';
+      fc.style.display='inline-flex';
+      dz.classList.add('has-file');
+    }
+  });
+  document.getElementById('mi').addEventListener('keydown',e=>{
+    if(e.key==='Enter'&&e.ctrlKey)rT();
+  });
+});
+</script>
+</body>
+</html>

smishing_detector/evaluate.py

@@ -0,0 +1,116 @@
+import torch
+import os
+import sys
+from sklearn.metrics import classification_report, confusion_matrix, f1_score, accuracy_score
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from utils.data_loader import load_dataset, split_dataset
+from predictor import SmishingPredictor
+from adversarial.evasion import run_adversarial_evaluation
+
+
+DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+CHECKPOINT = "best_model.pt"
+
+
+def main():
+    if not os.path.exists(CHECKPOINT):
+        print(f"Error: Model checkpoint '{CHECKPOINT}' not found. Run train.py first.")
+        return
+
+    print("Loading dataset...")
+    df = load_dataset()
+
+    train_df, val_df, test_df = split_dataset(df)
+
+    print("Loading model...")
+    predictor = SmishingPredictor(CHECKPOINT)
+
+    print("Evaluating on test set...")
+    test_messages = test_df['message'].tolist()
+    test_labels = test_df['label'].tolist()
+
+    predictions = []
+    for msg in test_messages:
+        result = predictor.predict(msg)
+        predictions.append(1 if result['label'] == 'spam' else 0)
+
+    print("\n" + "="*60)
+    print("TEST SET RESULTS — SmishingDetector (XLM-RoBERTa + URL Fusion)")
+    print("="*60)
+
+    print("\nClassification Report:")
+    print(classification_report(test_labels, predictions, target_names=['ham', 'spam']))
+
+    cm = confusion_matrix(test_labels, predictions)
+    print("Confusion Matrix:")
+    print(cm)
+
+    fpr = cm[0][1] / (cm[0][0] + cm[0][1]) if (cm[0][0] + cm[0][1]) > 0 else 0
+    fnr = cm[1][0] / (cm[1][0] + cm[1][1]) if (cm[1][0] + cm[1][1]) > 0 else 0
+
+    print(f"False Positive Rate: {fpr:.4f}  (ham flagged as spam)")
+    print(f"False Negative Rate: {fnr:.4f}  (spam missed)")
+
+    test_acc = (sum(1 for p, t in zip(predictions, test_labels) if p == t) / len(test_labels))
+    test_f1 = f1_score(test_labels, predictions, zero_division=0)
+
+    print("\n" + "="*60)
+    print("RESULTS SUMMARY")
+    print("="*60)
+    print(f"{'Metric':<25} {'Value':<20}")
+    print("-"*45)
+    print(f"{'Accuracy':<25} {f'{test_acc*100:.2f}%':<20}")
+    print(f"{'F1 (spam)':<25} {f'{test_f1:.4f}':<20}")
+    print(f"{'False Positive Rate':<25} {f'{fpr*100:.2f}%':<20}")
+
+    print("\n" + "="*60)
+    print("ADVERSARIAL ROBUSTNESS")
+    print("="*60)
+
+    adversarial_results = run_adversarial_evaluation(predictor, test_df, spam_only=True)
+
+    print(f"{'Attack':<15} {'Original F1':<15} {'Attacked F1':<15} {'Drop':<10}")
+    print("-"*55)
+    for _, row in adversarial_results.iterrows():
+        print(f"{row['attack_type']:<15} {row['original_f1']:<15.2f} {row['attacked_f1']:<15.2f} {row['accuracy_drop']:<10.2f}")
+
+    # ── Multilingual evaluation ───────────────────────────────────────────────
+    print("\n" + "="*60)
+    print("MULTILINGUAL EVALUATION")
+    print("="*60)
+    print("Evaluating model on Hindi/Hinglish held-out test data...")
+
+    try:
+        from utils.multilingual_loader import load_all_multilingual_test_data
+
+        lang_data = load_all_multilingual_test_data()
+
+        print(f"\n{'Language':<12} {'Accuracy':<12} {'F1':<10} {'FPR':<10}")
+        print("-"*45)
+
+        for lang_name, lang_df in lang_data.items():
+            if len(lang_df) == 0:
+                continue
+            lang_messages = lang_df['message'].tolist()
+            lang_labels   = lang_df['label'].tolist()
+            lang_preds    = [1 if predictor.predict(m)['label'] == 'spam' else 0
+                             for m in lang_messages]
+
+            lang_acc = accuracy_score(lang_labels, lang_preds)
+            lang_f1  = f1_score(lang_labels, lang_preds, zero_division=0)
+            lang_cm  = confusion_matrix(lang_labels, lang_preds)
+            lang_fpr = lang_cm[0][1] / (lang_cm[0][0] + lang_cm[0][1]) \
+                       if (lang_cm[0][0] + lang_cm[0][1]) > 0 else 0
+
+            print(f"{lang_name:<12} {lang_acc*100:<12.2f} {lang_f1:<10.4f} {lang_fpr*100:<10.2f}")
+
+    except Exception as e:
+        print(f"Multilingual evaluation failed: {e}")
+
+    print("\nEvaluation complete!")
+
+
+if __name__ == "__main__":
+    main()

smishing_detector/evaluate_custom.py

@@ -0,0 +1,176 @@
+"""
+Evaluate ScamShield on your own messages.
+
+Examples:
+    python evaluate_custom.py --input my_sms.csv
+    python evaluate_custom.py --input my_sms.csv --output predictions.csv
+
+Input can be:
+    - CSV/TSV with a "message" column and optional "label" column
+    - TXT with one SMS per line
+
+Labels, when present, may be: spam/ham, 1/0, scam/safe.
+"""
+
+import argparse
+import csv
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+
+LABEL_MAP = {
+    "spam": "spam",
+    "scam": "spam",
+    "phishing": "spam",
+    "smishing": "spam",
+    "1": "spam",
+    "true": "spam",
+    "ham": "ham",
+    "safe": "ham",
+    "legit": "ham",
+    "legitimate": "ham",
+    "0": "ham",
+    "false": "ham",
+}
+
+
+def normalize_label(value):
+    if value is None:
+        return None
+    text = str(value).strip().lower()
+    return LABEL_MAP.get(text)
+
+
+def sniff_delimiter(path):
+    suffix = path.suffix.lower()
+    if suffix == ".tsv":
+        return "\t"
+    return ","
+
+
+def load_rows(input_path):
+    path = Path(input_path)
+    if not path.exists():
+        raise FileNotFoundError(f"Input file not found: {path}")
+
+    if path.suffix.lower() == ".txt":
+        rows = []
+        with path.open("r", encoding="utf-8-sig") as f:
+            for line in f:
+                message = line.strip()
+                if message:
+                    rows.append({"message": message, "label": None})
+        return rows
+
+    with path.open("r", encoding="utf-8-sig", newline="") as f:
+        reader = csv.DictReader(f, delimiter=sniff_delimiter(path))
+        if not reader.fieldnames or "message" not in reader.fieldnames:
+            raise ValueError('CSV/TSV input must contain a "message" column.')
+
+        rows = []
+        for row in reader:
+            message = (row.get("message") or "").strip()
+            if not message:
+                continue
+            rows.append({
+                "message": message,
+                "label": normalize_label(row.get("label")),
+            })
+        return rows
+
+
+def evaluate(rows, checkpoint):
+    from predictor import SmishingPredictor
+
+    predictor = SmishingPredictor(checkpoint)
+    results = []
+
+    for row in rows:
+        pred = predictor.predict(row["message"])
+        expected = row.get("label")
+        got = pred["label"]
+        correct = None if expected is None else expected == got
+        results.append({
+            "expected": expected or "",
+            "predicted": got,
+            "correct": "" if correct is None else str(correct).lower(),
+            "confidence": pred["confidence"],
+            "risk_level": pred["risk_level"],
+            "language": pred.get("language", ""),
+            "neural_score": pred.get("_neural_score", ""),
+            "rule_score": pred.get("_rule_score", ""),
+            "ham_rule_score": pred.get("_ham_rule_score", ""),
+            "rule_weight": pred.get("_rule_weight", ""),
+            "message": row["message"],
+        })
+
+    return results
+
+
+def print_summary(results):
+    labelled = [r for r in results if r["expected"]]
+    print(f"\nEvaluated {len(results)} messages")
+
+    if labelled:
+        correct = sum(1 for r in labelled if r["correct"] == "true")
+        spam_total = sum(1 for r in labelled if r["expected"] == "spam")
+        ham_total = sum(1 for r in labelled if r["expected"] == "ham")
+        false_pos = sum(1 for r in labelled if r["expected"] == "ham" and r["predicted"] == "spam")
+        false_neg = sum(1 for r in labelled if r["expected"] == "spam" and r["predicted"] == "ham")
+
+        print(f"Labelled accuracy: {correct}/{len(labelled)} ({correct / len(labelled):.1%})")
+        print(f"Ham labelled: {ham_total}, spam labelled: {spam_total}")
+        print(f"False positives: {false_pos}, false negatives: {false_neg}")
+
+    print("\nTop misses / borderline cases:")
+    misses = [r for r in results if r["correct"] == "false"]
+    borderline = sorted(
+        results,
+        key=lambda r: abs(float(r["confidence"]) - 0.55),
+    )[:10]
+    for r in (misses[:10] or borderline[:10]):
+        expected = r["expected"] or "?"
+        print(
+            f"- exp={expected:<4} got={r['predicted']:<4} "
+            f"conf={float(r['confidence']):.2f} "
+            f"neural={r['neural_score']} rule={r['rule_score']} ham_rule={r['ham_rule_score']} "
+            f"lang={r['language']} :: {r['message'][:120]}"
+        )
+
+
+def write_results(results, output_path):
+    fields = [
+        "expected", "predicted", "correct", "confidence", "risk_level",
+        "language", "neural_score", "rule_score", "ham_rule_score", "rule_weight", "message",
+    ]
+    with Path(output_path).open("w", encoding="utf-8", newline="") as f:
+        writer = csv.DictWriter(f, fieldnames=fields)
+        writer.writeheader()
+        writer.writerows(results)
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--input", required=True, help="CSV/TSV/TXT file of messages")
+    parser.add_argument("--output", help="Optional CSV path for detailed predictions")
+    parser.add_argument(
+        "--checkpoint",
+        default=os.path.join(os.path.dirname(os.path.abspath(__file__)), "best_model.pt"),
+        help="Path to best_model.pt",
+    )
+    args = parser.parse_args()
+
+    rows = load_rows(args.input)
+    results = evaluate(rows, args.checkpoint)
+    print_summary(results)
+
+    if args.output:
+        write_results(results, args.output)
+        print(f"\nSaved detailed predictions to {args.output}")
+
+
+if __name__ == "__main__":
+    main()

smishing_detector/evaluate_multilingual.py

@@ -0,0 +1,139 @@
+"""
+evaluate_multilingual.py
+------------------------
+Multilingual evaluation script.
+Tests the smishing detector on Hindi and Hinglish messages.
+
+Run:
+    python evaluate_multilingual.py
+"""
+
+import torch
+import numpy as np
+from sklearn.metrics import (
+    classification_report, confusion_matrix,
+    f1_score, accuracy_score
+)
+import sys, os
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from predictor import SmishingPredictor
+from utils.multilingual_loader import load_all_multilingual_test_data
+
+CHECKPOINT = "best_model.pt"
+THRESHOLD  = 0.5
+
+
+def evaluate_language_subset(predictor, df, language_name: str):
+    """Run evaluation on a single language subset."""
+    if len(df) == 0:
+        print(f"  No {language_name} data available")
+        return None
+
+    messages = df['message'].tolist()
+    true_labels = df['label'].tolist()
+
+    predictions = []
+    confidences = []
+
+    for msg in messages:
+        result = predictor.predict(msg)
+        predictions.append(1 if result['label'] == 'spam' else 0)
+        confidences.append(result['confidence'])
+
+    acc = accuracy_score(true_labels, predictions)
+    f1  = f1_score(true_labels, predictions, zero_division=0)
+    cm  = confusion_matrix(true_labels, predictions)
+
+    fpr = 0.0
+    fnr = 0.0
+    if cm.shape == (2, 2):
+        fpr = cm[0][1] / (cm[0][0] + cm[0][1]) if (cm[0][0] + cm[0][1]) > 0 else 0
+        fnr = cm[1][0] / (cm[1][0] + cm[1][1]) if (cm[1][0] + cm[1][1]) > 0 else 0
+
+    return {
+        'language': language_name,
+        'total': len(df),
+        'spam': int(df['label'].sum()),
+        'ham': len(df) - int(df['label'].sum()),
+        'accuracy': acc,
+        'f1': f1,
+        'fpr': fpr,
+        'fnr': fnr,
+        'confusion_matrix': cm,
+        'predictions': predictions,
+        'true_labels': true_labels
+    }
+
+
+def main():
+    if not os.path.exists(CHECKPOINT):
+        print(f"Error: '{CHECKPOINT}' not found. Run train.py first.")
+        return
+
+    print("Loading model...")
+    predictor = SmishingPredictor(CHECKPOINT)
+
+    print("\nLoading multilingual test data...")
+    lang_data = load_all_multilingual_test_data()
+
+    results = {}
+    for lang_name, df in lang_data.items():
+        results[lang_name] = evaluate_language_subset(predictor, df, lang_name)
+
+    # ── Print results ──────────────────────────────────────────────────────
+    print("\n" + "="*65)
+    print(" MULTILINGUAL EVALUATION RESULTS")
+    print(" Model tested on:  Hindi + Hinglish messages")
+    print("="*65)
+
+    print(f"\n{'Language':<15} {'Messages':<10} {'Accuracy':<12} {'F1':<10} {'FPR':<10} {'FNR':<10}")
+    print("-"*65)
+
+    for lang, result in results.items():
+        if result:
+            print(f"{result['language']:<15} "
+                  f"{result['total']:<10} "
+                  f"{result['accuracy']*100:<12.2f} "
+                  f"{result['f1']:<10.4f} "
+                  f"{result['fpr']*100:<10.2f} "
+                  f"{result['fnr']*100:<10.2f}")
+
+    print("\n" + "="*65)
+    print(" TARGET F1 CHECK")
+    print("="*65)
+    print(f"{'Language':<15} {'F1 Score':<12} {'Beats 0.85 target?':<20}")
+    print("-"*45)
+    for lang, result in results.items():
+        if result:
+            beats = "✓ YES" if result['f1'] >= 0.85 else "✗ NO"
+            print(f"{result['language']:<15} {result['f1']:<12.4f} {beats:<20}")
+
+    print("\n" + "="*65)
+    print(" DETAILED CLASSIFICATION REPORTS")
+    print("="*65)
+
+    for lang, result in results.items():
+        if result:
+            print(f"\n--- {result['language'].upper()} ---")
+            print(classification_report(
+                result['true_labels'],
+                result['predictions'],
+                target_names=['ham', 'spam']
+            ))
+            print(f"Confusion Matrix:\n{result['confusion_matrix']}")
+
+    print("\n" + "="*65)
+    print(" F1 VERIFICATION")
+    print("="*65)
+    combined = results.get('combined')
+    if combined:
+        print(f"\nCombined Hindi+Hinglish F1 = {combined['f1']:.4f}")
+        print(f"Target (>0.85): {'MET ✓' if combined['f1'] >= 0.85 else 'NOT MET ✗'}")
+
+    print("\nZero-shot evaluation complete!")
+
+
+if __name__ == "__main__":
+    main()

smishing_detector/explainability/shap_explainer.py

@@ -0,0 +1,105 @@
+import numpy as np
+import torch
+import shap
+import matplotlib.pyplot as plt
+from matplotlib import colors as mcolors
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from predictor import SmishingPredictor
+from utils.data_loader import url_features, text_features, clean_text, get_feature_columns
+from models.model import get_tokenizer, MAX_LEN
+
+
+class SmishingExplainer:
+    def __init__(self, predictor: SmishingPredictor):
+        self.predictor = predictor
+
+    def _get_prediction_function(self):
+        def predict_fn(texts):
+            results = []
+            for text in texts:
+                cleaned = clean_text(text)
+
+                encoding = self.predictor.tokenizer(
+                    cleaned,
+                    max_length=MAX_LEN,
+                    padding='max_length',
+                    truncation=True,
+                    return_tensors='pt'
+                )
+
+                input_ids = encoding['input_ids'].to(self.predictor.device)
+                attention_mask = encoding['attention_mask'].to(self.predictor.device)
+
+                url_feats = url_features(text)
+                text_feats = text_features(text)
+
+                feature_cols = get_feature_columns()
+                combined = {**url_feats, **text_feats}
+                raw = np.array([[combined[col] for col in feature_cols]], dtype=np.float32)
+                norm = (raw - self.predictor.feature_mins) / self.predictor.feature_ranges
+                hand_features = torch.from_numpy(norm).to(self.predictor.device)
+
+                prob = self.predictor.model.predict_proba(input_ids, attention_mask, hand_features).item()
+                results.append(prob)
+
+            return np.array(results)
+
+        return predict_fn
+
+    def explain_text(self, message: str, num_features: int = 10) -> dict:
+        predict_fn = self._get_prediction_function()
+
+        tokenizer = self.predictor.tokenizer
+        masker = shap.maskers.Text(tokenizer)
+
+        explainer = shap.Explainer(predict_fn, masker)
+
+        shap_values = explainer([message])
+
+        tokens = [str(t) for t in shap_values.data[0]]
+        values = shap_values.values[0]
+
+        token_importance = list(zip(tokens, values))
+        token_importance.sort(key=lambda x: x[1], reverse=True)
+
+        top_spam = [(t, v) for t, v in token_importance if v > 0][:num_features]
+        top_ham = [(t, v) for t, v in token_importance if v < 0][-num_features:]
+        top_ham.sort(key=lambda x: x[1])
+
+        feature_cols = get_feature_columns()
+        url_feats = url_features(message)
+        text_feats = text_features(message)
+        combined = {**url_feats, **text_feats}
+
+        feature_importances = {col: combined[col] for col in feature_cols}
+
+        return {
+            "top_spam_words": top_spam,
+            "top_ham_words": top_ham,
+            "feature_importances": feature_importances
+        }
+
+    def plot_explanation(self, message: str) -> plt.Figure:
+        explanation = self.explain_text(message, num_features=10)
+
+        fig, ax = plt.subplots(figsize=(10, 6))
+
+        all_words = explanation["top_spam_words"] + explanation["top_ham_words"]
+        all_words.sort(key=lambda x: x[1], reverse=True)
+
+        words = [w for w, v in all_words[:10]]
+        values = [v for w, v in all_words[:10]]
+
+        colors = ['#d62728' if v > 0 else '#2ca02c' for v in values]
+
+        ax.barh(words, values, color=colors)
+        ax.axvline(x=0, color='black', linestyle='-', linewidth=0.5)
+        ax.set_xlabel('SHAP Value')
+        ax.set_title('SHAP Explanation for Spam Detection')
+
+        plt.tight_layout()
+        return fig

smishing_detector/manual_test.py

@@ -0,0 +1,133 @@
+"""
+manual_test.py — Comprehensive model testing across all categories.
+
+Run with:
+    cd smishing_detector && python manual_test.py
+"""
+
+import sys, os
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from predictor import SmishingPredictor
+
+MODEL_PATH = os.path.join(os.path.dirname(os.path.abspath(__file__)), "best_model.pt")
+
+# Format: (category, expected_label, message)
+# expected_label: "spam" or "ham"
+TEST_CASES = [
+
+    # ── English SPAM (phishing) ───────────────────────────────────────────────
+    ("EN-SPAM", "spam", "URGENT: Your bank account has been suspended. Click http://verify-bank.xyz/login to reactivate immediately."),
+    ("EN-SPAM", "spam", "Congratulations! You've won a $10,000 Amazon gift card. Claim now: http://prize-claim.top/win?id=8821"),
+    ("EN-SPAM", "spam", "Your package could not be delivered. Pay $2.99 customs fee at http://dhl-fee.net/track or it will be returned."),
+    ("EN-SPAM", "spam", "HMRC: You have a tax refund of £842.50 pending. Claim at http://hmrc-refund.co/apply before it expires."),
+    ("EN-SPAM", "spam", "Your Netflix account will be suspended. Update payment details: http://netflix-billing.info/update"),
+    ("EN-SPAM", "spam", "Your SBI account is blocked due to KYC mismatch. Verify now: http://sbi-kyc-verify.net/update or lose access."),
+    ("EN-SPAM", "spam", "CONGRATULATIONS! You have been selected as the lucky winner of our Rs.5,00,000 lottery. Call: 9800012345"),
+    ("EN-SPAM", "spam", "Your PAN card has been deactivated. Reactivate at http://pan-reactivate.online/verify with your Aadhaar."),
+
+    # ── English HAM (legit) ───────────────────────────────────────────────────
+    ("EN-HAM", "ham", "Your Amazon order of Wireless Headphones has been shipped. Expected delivery: Friday, May 31."),
+    ("EN-HAM", "ham", "HDFC Bank: Your a/c XX4521 credited Rs.25,000 on 30-May. Avl Bal: Rs.1,42,356. -HDFC Bank"),
+    ("EN-HAM", "ham", "Your Airtel recharge of Rs.239 is successful. Validity: 28 days. Data: 1.5GB/day."),
+    ("EN-HAM", "ham", "Your OTP for SBI net banking login is 847261. Valid for 10 minutes. Do not share with anyone."),
+    ("EN-HAM", "ham", "Dear Customer, your IRCTC ticket PNR 4892731 for 31-May (New Delhi to Mumbai) is confirmed."),
+    ("EN-HAM", "ham", "PhonePe: Rs.500 received from Rahul Kumar on 30-May at 3:45 PM. UPI Ref: 4893721019."),
+    ("EN-HAM", "ham", "Flipkart: Your order #OD11234 has been delivered. Rate your experience at flipkart.com/orders"),
+    ("EN-HAM", "ham", "Zepto: Your order of Milk, Eggs, Bread has been dispatched. Arriving in 10 minutes!"),
+
+    # ── Hindi SPAM ────────────────────────────────────────────────────────────
+    ("HI-SPAM", "spam", "प्रिय ग्राहक, आपका बिजली कनेक्शन आज रात 9:30 बजे काट दिया जाएगा। अभी कॉल करें: 9876543210"),
+    ("HI-SPAM", "spam", "आपके खाते में कोई संदिग्ध गतिविधि देखी गई है। KYC अपडेट करें: http://sbi-kyc-update.xyz"),
+    ("HI-SPAM", "spam", "आयकर विभाग: आपके खिलाफ FIR दर्ज होने वाली है। तत्काल संपर्क करें: 9911000000"),
+
+    # ── Hinglish SPAM ─────────────────────────────────────────────────────────
+    ("HL-SPAM", "spam", "Aapka electricity connection aaj raat 9:30 PM ko band ho jayega. Turant call karein: 98765XXXXX"),
+    ("HL-SPAM", "spam", "Aapka SBI bank account suspend ho gaya hai. Abhi KYC kijiye nahi to permanently band ho jayega: http://sbi-kyc.xyz"),
+    ("HL-SPAM", "spam", "Congratulations! Aapne 50,000 rupaye ka lucky draw jeeta hai. Claim karne ke liye call karein: 9000012345"),
+    ("HL-SPAM", "spam", "CBI notice: Aapke naam pe money laundering case darj hua hai. Digital arrest se bachne ke liye turant contact karein officer ko."),
+    ("HL-SPAM", "spam", "Aapka UPI ID expire ho raha hai. 2 ghante mein renew karein: http://upi-renew.club/verify"),
+    ("HL-SPAM", "spam", "Income Tax Department: Aapke account mein suspicious transaction mili hai. FIR darj hogi. Abhi call karein: 9912345678"),
+    ("HL-SPAM", "spam", "Aapka Aadhaar card block ho jayega 24 ghante mein. Update karein: http://uidai-update.xyz/verify"),
+
+    # ── Legit Indian SMS (false-positive risk) ────────────────────────────────
+    ("IN-HAM", "ham", "Dear Customer, your HDFC Bank a/c XX9821 credited Rs.12,500.00 on 30-May. Avl bal: Rs.87,432.10."),
+    ("IN-HAM", "ham", "Airtel: Congratulations! Your mobile number is eligible for a free 5G SIM upgrade. Visit your nearest Airtel store."),
+    ("IN-HAM", "ham", "IRCTC: OTP for your ticket booking is 739182. Valid for 5 minutes. Do NOT share with anyone."),
+    ("IN-HAM", "ham", "Bijli Bill: Aapka MSEB bijli bill Rs.1,847 generate ho gaya hai. Due date: 10-Jun-26. Pay at mseb.co.in"),
+    ("IN-HAM", "ham", "Paytm: Your order #ORD884521 of Rs.1,299 has been placed. Track at paytm.com/orders."),
+    ("IN-HAM", "ham", "Jio: Your plan of Rs.299 has been renewed. 1.5GB/day for 28 days. Thanks for choosing Jio!"),
+
+    # ── Adversarial / edge cases (no expected label — note in output only) ────
+    ("EDGE", None, "Click here http://bit.ly/3xK9Lmn"),
+    ("EDGE", None, "Call back on this number immediately: 9876543210"),
+    ("EDGE", None, "Free Recharge! Get Rs.1000 talktime free. Limited offer. Reply YES to claim."),
+    ("EDGE", None, "Dear Sir, your loan of Rs.5,00,000 at 8.5% p.a. is approved. Contact us to proceed."),
+    ("EDGE", None, "Your SBI account is safe. No action needed. This is a test message from SBI fraud team."),
+
+    # ── GREEN CHANNEL tests: promo/ad spam with legit URLs should NOT be "spam" ─
+    # These are ads/promos (spammy language) but NOT scams
+    ("GREEN", "safe", "Congratulations! You're eligible for a special cashback offer on Amazon. Shop now at amazon.in/offers"),
+    ("GREEN", "safe", "Flipkart Big Billion Sale! Exclusive deals for you. Up to 80% off! Visit flipkart.com/sale"),
+    ("GREEN", "safe", "WINNER! You've been selected for a special Netflix upgrade. Enjoy 3 months free at netflix.com/upgrade"),
+
+    # These ARE scams — green channel must NOT clear them
+    ("GN-SCAM", "spam", "WINNER! You've been selected for Rs.5,00,000 prize. Claim at http://prize-winner.xyz/claim"),
+    ("GN-SCAM", "spam", "Your Netflix account will be suspended. Update payment details: http://netflix-billing.info/update"),
+    ("GN-SCAM", "spam", "Amazon: Your account is locked. Verify immediately at http://amaz0n-verify.top/login"),
+]
+
+
+def run_tests():
+    print(f"Loading model from {MODEL_PATH}...")
+    predictor = SmishingPredictor(MODEL_PATH)
+    print()
+
+    stats = {"correct": 0, "total": 0, "by_cat": {}}
+
+    header = f"{'Category':<10} {'Exp':<5} {'Got':<5} {'Conf':>6}  {'Risk':<8} {'Lang':<9} {'Status'}"
+    print(header)
+    print("─" * len(header))
+
+    for category, expected, text in TEST_CASES:
+        result    = predictor.predict(text)
+        got_label = result["label"]
+        conf      = result["confidence"]
+        risk      = result.get("risk_level", "?")
+        lang      = result.get("language", "?")
+
+        if expected is None:
+            status = "EDGE"
+        else:
+            # 'safe' (green channel) counts as correct when expected is 'ham' or 'safe'
+            if expected in ("ham", "safe"):
+                correct = got_label in ("ham", "safe")
+            else:
+                correct = got_label == expected
+            status  = "\u2713" if correct else "\u2717 WRONG"
+            cat_key = category.split("-")[0]
+            stats["total"] += 1
+            stats["correct"] += correct
+            stats["by_cat"].setdefault(cat_key, [0, 0])
+            stats["by_cat"][cat_key][0] += correct
+            stats["by_cat"][cat_key][1] += 1
+
+        exp_str = (expected or "?").upper()[:4]
+        got_str = got_label.upper()[:4]
+        gc = result.get("green_channel", False)
+        gc_tag = " [GC]" if gc else ""
+        print(f"{category:<10} {exp_str:<5} {got_str:<5} {conf:>6.1%}  {risk:<8} {lang:<9} {status}{gc_tag}")
+        if status == "\u2717 WRONG":
+            print(f"           \u21b3 {text[:90]}{'...' if len(text)>90 else ''}")
+
+    print("─" * len(header))
+    acc = stats["correct"] / stats["total"] * 100 if stats["total"] else 0
+    print(f"\nOverall: {stats['correct']}/{stats['total']} ({acc:.1f}%)\n")
+    print("By category:")
+    for cat, (ok, total) in sorted(stats["by_cat"].items()):
+        pct = ok / total * 100
+        bar = "█" * int(pct // 10) + "░" * (10 - int(pct // 10))
+        print(f"  {cat:<6} [{bar}] {pct:5.1f}%  ({ok}/{total})")
+
+
+if __name__ == "__main__":
+    run_tests()

smishing_detector/models/dataset.py

@@ -0,0 +1,93 @@
+import numpy as np
+import pandas as pd
+import torch
+from torch.utils.data import DataLoader, Dataset
+
+
+class SMSDataset(Dataset):
+    def __init__(
+        self,
+        df: pd.DataFrame,
+        tokenizer,
+        max_len: int = 128,
+        feature_mins: np.ndarray = None,
+        feature_ranges: np.ndarray = None,
+    ):
+        from utils.data_loader import get_feature_columns
+
+        self.texts = df["message"].astype(str).tolist()
+        self.labels = df["label"].values.astype(np.float32)
+        self.tokenizer = tokenizer
+        self.max_len = max_len
+
+        feature_cols = get_feature_columns()
+        missing = [col for col in feature_cols if col not in df.columns]
+        if missing:
+            raise ValueError(f"Missing feature columns: {missing}")
+
+        features = df[feature_cols].values.astype(np.float32)
+        features = np.nan_to_num(features, nan=0.0, posinf=0.0, neginf=0.0)
+
+        if feature_mins is None or feature_ranges is None:
+            self.feature_mins = features.min(axis=0)
+            ranges = features.max(axis=0) - self.feature_mins
+            self.feature_ranges = np.where(ranges == 0, 1.0, ranges).astype(np.float32)
+        else:
+            self.feature_mins = np.asarray(feature_mins, dtype=np.float32)
+            self.feature_ranges = np.asarray(feature_ranges, dtype=np.float32)
+            self.feature_ranges = np.where(self.feature_ranges == 0, 1.0, self.feature_ranges)
+
+        features = (features - self.feature_mins) / self.feature_ranges
+        features = np.nan_to_num(features, nan=0.0, posinf=3.0, neginf=-2.0)
+        self.features = np.clip(features, -2.0, 3.0).astype(np.float32)
+
+    def __len__(self):
+        return len(self.texts)
+
+    def __getitem__(self, idx):
+        encoding = self.tokenizer(
+            self.texts[idx],
+            max_length=self.max_len,
+            padding="max_length",
+            truncation=True,
+            return_tensors="pt",
+        )
+
+        return {
+            "input_ids": encoding["input_ids"].squeeze(0),
+            "attention_mask": encoding["attention_mask"].squeeze(0),
+            "hand_features": torch.from_numpy(self.features[idx]),
+            "label": torch.tensor(self.labels[idx], dtype=torch.float32),
+        }
+
+
+def build_dataloaders(train_df, val_df, test_df, tokenizer, batch_size=32):
+    train_dataset = SMSDataset(train_df, tokenizer)
+    val_dataset = SMSDataset(
+        val_df,
+        tokenizer,
+        feature_mins=train_dataset.feature_mins,
+        feature_ranges=train_dataset.feature_ranges,
+    )
+    test_dataset = SMSDataset(
+        test_df,
+        tokenizer,
+        feature_mins=train_dataset.feature_mins,
+        feature_ranges=train_dataset.feature_ranges,
+    )
+
+    loader_kwargs = {
+        "batch_size": batch_size,
+        "num_workers": 2,
+        "pin_memory": torch.cuda.is_available(),
+    }
+
+    train_loader = DataLoader(train_dataset, shuffle=True, **loader_kwargs)
+    val_loader = DataLoader(val_dataset, shuffle=False, **loader_kwargs)
+    test_loader = DataLoader(test_dataset, shuffle=False, **loader_kwargs)
+
+    norm_stats = {
+        "feature_mins": train_dataset.feature_mins,
+        "feature_ranges": train_dataset.feature_ranges,
+    }
+    return train_loader, val_loader, test_loader, norm_stats

smishing_detector/models/model.py

@@ -0,0 +1,61 @@
+import torch
+import torch.nn as nn
+from transformers import XLMRobertaModel, XLMRobertaTokenizerFast
+
+
+MODEL_NAME = "xlm-roberta-base"
+MAX_LEN = 128
+NUM_HANDCRAFTED = 17
+
+
+class SmishingDetector(nn.Module):
+    def __init__(self, num_handcrafted: int = 17, dropout: float = 0.3, freeze_bert_layers: int = 0):
+        super().__init__()
+
+        # XLM-RoBERTa encoder
+        # xlm-roberta-base has 12 transformer layers with 768-d hidden size
+        self.bert = XLMRobertaModel.from_pretrained(MODEL_NAME)
+
+        # Freeze bottom N layers if specified
+        for i, layer in enumerate(self.bert.encoder.layer):
+            if i < freeze_bert_layers:
+                for param in layer.parameters():
+                    param.requires_grad = False
+
+        self.feat_proj = nn.Sequential(
+            nn.Linear(num_handcrafted, 64),
+            nn.ReLU(),
+            nn.Dropout(dropout),
+            nn.Linear(64, 64),
+            nn.ReLU()
+        )
+
+        classifier_input_dim = 768 + 64
+        self.classifier = nn.Sequential(
+            nn.Linear(classifier_input_dim, 256),
+            nn.ReLU(),
+            nn.Dropout(dropout),
+            nn.Linear(256, 64),
+            nn.ReLU(),
+            nn.Dropout(dropout),
+            nn.Linear(64, 1)
+        )
+
+    def forward(self, input_ids, attention_mask, hand_features):
+        # XLM-RoBERTa output format is same as BERT
+        outputs = self.bert(input_ids=input_ids, attention_mask=attention_mask)
+        cls_emb = outputs.last_hidden_state[:, 0, :]   # CLS token → (B, 768)
+        feat_emb = self.feat_proj(hand_features)        # (B, 64)
+        fused = torch.cat([cls_emb, feat_emb], dim=1)  # (B, 832)
+        logit = self.classifier(fused)
+        return logit.squeeze(-1)
+
+    def predict_proba(self, input_ids, attention_mask, hand_features):
+        with torch.no_grad():
+            logit = self.forward(input_ids, attention_mask, hand_features)
+            return torch.sigmoid(logit)
+
+
+def get_tokenizer():
+    # XLM-RoBERTa tokenizer handles 100 languages automatically
+    return XLMRobertaTokenizerFast.from_pretrained(MODEL_NAME)

smishing_detector/predictor.py

@@ -0,0 +1,390 @@
+"""
+Prediction engine for ScamShield.
+
+The neural model remains the primary classifier. Rules are used only as:
+  - spam floors: raise confidence when explicit phishing evidence is present
+  - ham ceilings: lower confidence for clear legitimate transactional SMS
+
+This avoids the old failure mode where a weak Hindi/Hinglish rule score could
+average down a strong neural spam prediction.
+"""
+
+import os
+import re
+import sys
+from typing import Dict, Iterable, List, Tuple
+
+import numpy as np
+import torch
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from models.model import MAX_LEN, SmishingDetector, get_tokenizer
+from utils.data_loader import (
+    clean_text,
+    extract_urls,
+    get_feature_columns,
+    text_features,
+    url_features,
+)
+
+
+DEVANAGARI_RE = re.compile(r"[\u0900-\u097F]")
+TOKEN_RE = re.compile(r"[a-z]+|[\u0900-\u097F]+")
+
+HINGLISH_MARKERS = {
+    "aap", "aapka", "aapke", "apka", "mera", "meri", "tumhara", "hamara",
+    "karo", "karein", "karna", "kar", "kiya", "kijiye", "dijiye",
+    "hai", "hain", "tha", "thi", "hoga", "hogi", "jayega", "jayegi",
+    "nahi", "nahin", "bhi", "aur", "ke", "ki", "ka", "mein", "se",
+    "par", "ko", "ne", "tak", "wala", "wali", "turant", "jaldi",
+    "abhi", "raat", "subah", "aaj", "kal", "rupaye", "paisa",
+    "khata", "bijli", "band",
+}
+
+LEGIT_BRANDS = {
+    "airtel", "jio", "bsnl", "vi", "vodafone", "idea", "amazon",
+    "flipkart", "swiggy", "zomato", "zepto", "blinkit", "meesho",
+    "myntra", "irctc", "uidai", "epfo", "hdfc", "icici", "sbi",
+    "axis", "kotak", "paytm", "phonepe", "gpay",
+}
+
+
+def detect_language(text: str) -> Tuple[str, float]:
+    """Return english, hinglish, or hindi with a simple confidence score."""
+    if DEVANAGARI_RE.search(text):
+        return "hindi", 0.95
+
+    tokens = set(re.findall(r"[a-z]+", text.lower()))
+    hits = len(tokens & HINGLISH_MARKERS)
+    if hits >= 3:
+        return "hinglish", min(0.55 + hits * 0.08, 0.95)
+    if hits:
+        return "hinglish", 0.45
+    return "english", 0.90
+
+
+SPAM_PATTERNS: List[Tuple[str, float]] = [
+    # Account, card, identity, and service suspension
+    (r"account.{0,24}(suspend|block|freez|clos|terminat|deactivat)", 0.45),
+    (r"(suspend|block|freez|terminat|deactivat).{0,30}(account|card|upi|sim|pan|aadhaar)", 0.45),
+    (r"(pan|aadhaar|aadhar)\s*(card\s*)?.{0,24}(block|suspend|deactivat|reactivat)", 0.45),
+    (r"upi\s*(id\s*)?.{0,18}(expir|deactivat|block|suspend)", 0.42),
+    (r"kyc.{0,20}(update|verify|complete|pending|expire)", 0.38),
+    (r"(verify|update|confirm).{0,30}(account|payment|billing|card|kyc|details)", 0.35),
+    # Delivery, fees, refunds, and prizes
+    (r"(parcel|package|shipment|delivery).{0,35}(fail|held|unable|fee|customs|returned)", 0.42),
+    (r"customs?\s*(fee|charge|duty|clearance|payment)", 0.40),
+    (r"(tax|hmrc|irs|income\s*tax).{0,30}(refund|rebate|return|pending|claim)", 0.42),
+    (r"(claim|collect|redeem).{0,30}(before|within|it\s*expires|now\s*at\s*http|at\s*http)", 0.38),
+    (r"(win|won|winner|selected|chosen|lucky).{0,45}(prize|reward|gift|lottery|cash|rs\.?|inr)", 0.45),
+    (r"loan.{0,35}(approved|eligible|sanction|offer).{0,40}(call|contact|whatsapp|apply)", 0.38),
+    # Hinglish social engineering
+    (r"bijli.{0,25}(cut|band|kataegi|kategi|nahi\s*aayegi)", 0.45),
+    (r"(electricity|power|connection).{0,24}(cut|band|disconnect)", 0.42),
+    (r"band\s*ho\s*(jayega|jaega|jaayega)", 0.35),
+    (r"khata.{0,20}(band|block|suspend|freez)", 0.42),
+    (r"(digital\s*arrest|money\s*launder|warrant|fir|giraftari|graftari)", 0.48),
+    (r"(cbi|ed|police|income\s*tax).{0,35}(notice|case|action|raid|fir|arrest)", 0.42),
+    # Devanagari Hindi equivalents, written as escapes to keep the file stable.
+    ("\u092c\u093f\u091c\u0932\u0940.{0,24}(\u0915\u091f|\u092c\u0902\u0926)", 0.45),
+    ("\u0915\u0928\u0947\u0915\u094d\u0936\u0928.{0,20}(\u0915\u091f|\u092c\u0902\u0926)", 0.42),
+    ("\u0916\u093e\u0924\u093e.{0,20}(\u092c\u0902\u0926|\u092c\u094d\u0932\u0949\u0915|\u092b\u094d\u0930\u0940\u091c)", 0.42),
+    ("(\u0915\u0947\u0935\u093e\u0908\u0938\u0940|kyc).{0,20}(\u0905\u092a\u0921\u0947\u091f|\u092a\u0942\u0930\u093e|\u0935\u0947\u0930\u093f\u092b)", 0.38),
+    ("\u0906\u0927\u093e\u0930.{0,20}(\u092c\u094d\u0932\u0949\u0915|\u092c\u0902\u0926|\u0928\u093f\u0932\u0902\u092c\u093f\u0924)", 0.45),
+    ("\u092a\u0948\u0928.{0,20}(\u092c\u094d\u0932\u0949\u0915|\u092c\u0902\u0926|\u0928\u093f\u0937\u094d\u0915\u094d\u0930\u093f\u092f)", 0.45),
+    ("\u0917\u093f\u0930\u092b\u094d\u0924\u093e\u0930|\u090f\u092b\u0906\u0908\u0906\u0930|\u0935\u093e\u0930\u0902\u091f|\u0921\u093f\u091c\u093f\u091f\u0932\\s*\u0905\u0930\u0947\u0938\u094d\u091f", 0.48),
+]
+
+HAM_PATTERNS: List[Tuple[str, float]] = [
+    # Banking and wallet confirmations
+    (r"(rs\.?|inr|\u20b9)\s*[\d,]+\.?\d*.{0,35}(credited|debited|received|paid|sent|withdrawn)", 0.58),
+    (r"(credited|debited|received|paid|sent|withdrawn).{0,35}(rs\.?|inr|\u20b9)\s*[\d,]+", 0.50),
+    (r"(avl|available|current)\s*(bal|balance)", 0.45),
+    (r"upi\s*(ref|reference)", 0.35),
+    (r"(do\s*not|never)\s*(share|give).{0,25}(otp|pin|code|password)", 0.55),
+    (r"(otp|one[\s-]?time|verification\s*code).{0,60}(valid|expires|login|transaction|payment)", 0.45),
+    # Recharge, travel, delivery, bills
+    (r"recharge.{0,45}(successful|done|activated|renewed)", 0.55),
+    (r"(order|parcel|shipment|package).{0,55}(shipped|dispatched|delivered|out\s*for\s*delivery)", 0.50),
+    (r"(estimated|expected)\s*(delivery|arrival)", 0.30),
+    (r"(ticket|booking|pnr).{0,55}(confirmed|booked|reserved)", 0.50),
+    (r"(bill|premium|policy).{0,60}(due|generated|paid|receipt)", 0.35),
+    # Telecom — legit promos, upgrades, store visits
+    (r"visit.{0,20}(nearest|our).{0,20}(store|branch|centre|outlet)", 0.35),
+    (r"eligible\s*(for)?\s*(a\s*)?(free\s*)?(sim|upgrade|service|plan|offer)", 0.30),
+    (r"(sim|5g|4g|network|plan)\s*(upgrade|migrat|activat)", 0.30),
+    # Hindi/Hinglish legitimate messages
+    ("\u0913\u091f\u0940\u092a\u0940|otp", 0.20),
+    ("\u0938\u093e\u091d\u093e|\u0936\u0947\u092f\u0930", 0.15),
+    ("(rs\\.?|inr|\u20b9)\\s*[\\d,]+.{0,35}(\u091c\u092e\u093e|\u0921\u0947\u092c\u093f\u091f|\u092d\u0941\u0917\u0924\u093e\u0928|\u092a\u094d\u0930\u093e\u092a\u094d\u0924)", 0.45),
+    ("\u092c\u093f\u0932.{0,45}(\u091c\u0947\u0928\u0930\u0947\u091f|\u0926\u0947\u092f|\u092d\u0941\u0917\u0924\u093e\u0928)", 0.35),
+]
+
+URGENCY_TOKENS = {
+    "urgent", "immediately", "now", "today", "limited", "last", "final",
+    "turant", "jaldi", "abhi", "aaj", "kal", "antim",
+    "\u0924\u0941\u0930\u0902\u0924", "\u091c\u0932\u094d\u0926\u0940",
+    "\u0905\u092d\u0940", "\u0906\u091c", "\u0915\u0932",
+}
+
+PHONE_RE = re.compile(r"(?:\+91[-\s]?)?\d[\d\s\-]{8,}\d")
+DEADLINE_RE = re.compile(
+    r"aaj\s*raat|kal\s*subah|\d{1,2}:\d{2}\s*(am|pm|baje)|"
+    r"\d+\s*(ghante|minute|mint)\s*(mein|tak|ke\s*andar)|"
+    r"\u0906\u091c\s*\u0930\u093e\u0924|\u0915\u0932\s*\u0938\u0941\u092c\u0939|"
+    r"\u092c\u091c\u0947\s*\u0924\u0915|\d+\s*(\u0918\u0902\u091f\u0947|\u092e\u093f\u0928\u091f)\s*(\u092e\u0947\u0902|\u0924\u0915)",
+    re.IGNORECASE,
+)
+
+
+def _tokens(text: str) -> set:
+    return set(TOKEN_RE.findall(text.lower()))
+
+
+def _sum_patterns(text: str, patterns: Iterable[Tuple[str, float]]) -> float:
+    msg = text.lower()
+    score = 0.0
+    for pattern, weight in patterns:
+        if re.search(pattern, msg, re.IGNORECASE):
+            score += weight
+    return min(score, 1.0)
+
+
+def spam_rule_score(message: str, uf: Dict[str, int]) -> float:
+    """Explicit phishing/scam confidence from transparent rules."""
+    score = _sum_patterns(message, SPAM_PATTERNS)
+    tokens = _tokens(message)
+
+    if tokens & URGENCY_TOKENS and PHONE_RE.search(message):
+        score += 0.25
+    if DEADLINE_RE.search(message):
+        score += 0.15
+    if uf.get("has_url"):
+        score += 0.15  # any URL + spam pattern match is a signal
+        if uf.get("suspicious_tld") or uf.get("has_ip_url") or uf.get("has_shortened_url"):
+            score += 0.25
+        if re.search(r"https?://\S*(verify|login|update|confirm|secure|kyc|account)\S*", message, re.IGNORECASE):
+            score += 0.20
+
+    return min(score, 1.0)
+
+
+def ham_rule_score(message: str, uf: Dict[str, int]) -> float:
+    """Legitimate transactional confidence from transparent rules."""
+    score = _sum_patterns(message, HAM_PATTERNS)
+    tokens = _tokens(message)
+
+    if tokens & LEGIT_BRANDS:
+        score += 0.18
+    if uf.get("has_url") and uf.get("has_legit_domain"):
+        score += 0.20
+    if uf.get("has_url") and (uf.get("suspicious_tld") or uf.get("has_ip_url") or uf.get("has_shortened_url")):
+        score -= 0.35
+
+    return max(0.0, min(score, 1.0))
+
+
+def combine_scores(neural: float, spam_rule: float, ham_rule: float, has_url: bool, has_legit_domain: bool) -> float:
+    """
+    Combine neural and rule scores.
+
+    Rules never average down spam evidence. They only set floors/ceilings.
+    """
+    final = float(neural)
+
+    if spam_rule >= 0.35:
+        final = max(final, spam_rule)
+
+    clear_legit = ham_rule >= 0.35 and spam_rule < 0.55
+    if clear_legit:
+        if not has_url:
+            cap = 1.0 - ham_rule * 0.82
+        elif has_legit_domain:
+            cap = 1.0 - ham_rule * 0.58
+        else:
+            cap = 1.0 - ham_rule * 0.25
+        final = min(final, cap)
+
+    return max(0.0, min(1.0, final))
+
+
+class SmishingPredictor:
+    def __init__(self, checkpoint_path: str = "best_model.pt"):
+        self.device = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+        self.tokenizer = get_tokenizer()
+
+        checkpoint = torch.load(checkpoint_path, map_location=self.device, weights_only=False)
+        self.model = SmishingDetector(
+            num_handcrafted=17,
+            dropout=0.3,
+            freeze_bert_layers=0,
+        ).to(self.device)
+        self.model.load_state_dict(checkpoint["model_state"])
+        self.model.eval()
+
+        self.threshold = float(checkpoint.get("threshold", 0.55))
+        self.feature_mins = np.array(checkpoint.get("feature_mins", [0.0] * 17), dtype=np.float32)
+        self.feature_ranges = np.array(checkpoint.get("feature_ranges", [1.0] * 17), dtype=np.float32)
+        self.feature_ranges = np.where(self.feature_ranges == 0, 1.0, self.feature_ranges)
+
+        print(
+            "SmishingPredictor loaded | "
+            f"threshold={self.threshold} | "
+            f"val_f1={checkpoint.get('val_f1', 'N/A')} | "
+            f"epoch={checkpoint.get('epoch', 'N/A')}"
+        )
+
+    def _handcrafted_features(self, message: str) -> Tuple[Dict[str, int], Dict[str, float], torch.Tensor]:
+        uf = url_features(message)
+        tf = text_features(message)
+        merged = {**uf, **tf}
+        raw = np.array([merged[col] for col in get_feature_columns()], dtype=np.float32)
+        norm = (raw - self.feature_mins) / self.feature_ranges
+        norm = np.nan_to_num(norm, nan=0.0, posinf=3.0, neginf=-2.0)
+        norm = np.clip(norm, -2.0, 3.0)
+        tensor = torch.from_numpy(norm.reshape(1, -1)).to(self.device)
+        return uf, tf, tensor
+
+    def _neural_score(self, message: str, hand_features: torch.Tensor) -> float:
+        cleaned = clean_text(message)
+        enc = self.tokenizer(
+            cleaned,
+            max_length=MAX_LEN,
+            padding="max_length",
+            truncation=True,
+            return_tensors="pt",
+        )
+        enc = {k: v.to(self.device) for k, v in enc.items()}
+
+        with torch.no_grad():
+            prob = self.model.predict_proba(enc["input_ids"], enc["attention_mask"], hand_features)
+        return float(prob.item())
+
+    def _green_channel(self, message: str, label: str, final_prob: float,
+                        spam_rule: float, ham_rule: float,
+                        uf: dict) -> Tuple[str, str, float, bool, str]:
+        """
+        Unified URL-aware channel checking.
+
+        For EVERY message that has URLs, check ALL of them against
+        GSB first, then static whitelist:
+
+         1. ANY URL → known_malicious  => SPAM (escalate)
+         2. ALL URLs → known_safe      => SAFE (green channel)
+         3. ANY URL → unverified       => keep model verdict (no override)
+         4. No URLs + ham patterns     => SAFE (promo/ad without links)
+        """
+        has_url = bool(uf.get("has_url"))
+        risk = "high" if final_prob >= 0.75 else "medium" if final_prob >= self.threshold else "low"
+
+        # ── URL checking (runs for ALL messages with URLs) ──────────────────
+        if has_url:
+            try:
+                import tldextract
+                urls = extract_urls(message)
+                if urls:
+                    # static whitelist
+                    static_legit = set()
+                    try:
+                        from utils.safe_browsing import get_checker
+                        static_legit |= get_checker().fallback_legit_domains
+                    except Exception:
+                        pass
+                    try:
+                        from utils.data_loader import LEGIT_DOMAINS
+                        static_legit |= LEGIT_DOMAINS
+                    except Exception:
+                        pass
+
+                    checker = None
+                    try:
+                        from utils.safe_browsing import get_checker as _gc
+                        checker = _gc()
+                    except Exception:
+                        pass
+
+                    all_safe = True
+                    for url in urls:
+                        ext = tldextract.extract(url)
+                        full_domain = f"{ext.domain}.{ext.suffix}".lower().strip(".")
+                        if not full_domain:
+                            continue
+
+                        # 1. GSB first
+                        status = "unknown"
+                        if checker:
+                            try:
+                                status = checker.check_domain_status(full_domain)
+                            except Exception:
+                                pass
+
+                        if status == "known_malicious":
+                            return "spam", "high", max(final_prob, 0.90), False, ""
+                        if status == "known_safe":
+                            continue
+                        if full_domain in static_legit:
+                            continue
+                        # unverified — don't green-channel
+                        all_safe = False
+                        break
+
+                    if all_safe:
+                        if label == "spam" and spam_rule >= 0.35:
+                            # message looks scammy but all URLs are legit → cap at medium
+                            return "spam", "medium", min(final_prob, 0.55), True, \
+                                "URLs verified legitimate but message content is suspicious"
+                        return "safe", "low", min(final_prob, 0.40), True, \
+                            "all URLs verified as legitimate domains"
+            except Exception:
+                pass
+
+            # URLs exist but at least one is unverified → keep model verdict
+            return label, risk, final_prob, False, ""
+
+        # ── No URLs: check for harmless promo/ad patterns ───────────────────
+        if ham_rule >= 0.35 and spam_rule < 0.35 and label == "spam":
+            return "safe", "low", min(final_prob, 0.35), True, \
+                "no URLs + legitimate transactional patterns detected"
+
+        return label, risk, final_prob, False, ""
+
+    def predict(self, message: str) -> dict:
+        lang, lang_conf = detect_language(message)
+        uf, tf, hand_features = self._handcrafted_features(message)
+
+        neural_prob = self._neural_score(message, hand_features)
+        spam_s = spam_rule_score(message, uf)
+        ham_s = ham_rule_score(message, uf)
+        final_prob = combine_scores(
+            neural_prob,
+            spam_s,
+            ham_s,
+            bool(uf.get("has_url")),
+            bool(uf.get("has_legit_domain")),
+        )
+
+        label = "spam" if final_prob >= self.threshold else "ham"
+        risk = "high" if final_prob >= 0.75 else "medium" if final_prob >= self.threshold else "low"
+
+        # Green channel: distinguish scams from harmless promo spam
+        label, risk, final_prob, green_cleared, green_reason = self._green_channel(
+            message, label, final_prob, spam_s, ham_s, uf
+        )
+
+        return {
+            "label": label,
+            "confidence": round(final_prob, 4),
+            "risk_level": risk,
+            "language": lang,
+            "language_confidence": round(lang_conf, 2),
+            "green_channel": green_cleared,
+            "green_reason": green_reason,
+            "url_signals": uf,
+            "text_signals": tf,
+            "_neural_score": round(neural_prob, 4),
+            "_rule_score": round(spam_s, 4),
+            "_ham_rule_score": round(ham_s, 4),
+            "_threshold": self.threshold,
+        }
+

smishing_detector/requirements.txt

@@ -0,0 +1,22 @@
+torch>=2.0.0
+transformers>=4.35.0
+datasets>=2.14.0
+ucimlrepo>=0.0.3
+scikit-learn>=1.3.0
+pandas>=2.0.0
+numpy>=1.24.0
+tldextract>=3.4.0
+requests>=2.31.0
+python-dotenv>=1.0.0
+shap>=0.43.0
+streamlit>=1.28.0
+flask>=3.0.0
+flask-cors>=4.0.0
+matplotlib>=3.7.0
+seaborn>=0.12.0
+nltk>=3.8.0
+regex>=2023.0.0
+sentencepiece>=0.1.99
+protobuf>=3.20.0
+kagglehub>=0.2.0
+cryptography>=42.0.0

smishing_detector/train.py

@@ -0,0 +1,200 @@
+import os
+import torch
+import torch.nn as nn
+from torch.optim import AdamW
+from transformers import get_linear_schedule_with_warmup
+from sklearn.metrics import accuracy_score, precision_score, recall_score, f1_score, classification_report, confusion_matrix
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+
+from utils.data_loader import load_dataset, split_dataset, get_feature_columns
+from models.model import SmishingDetector, get_tokenizer
+from models.dataset import build_dataloaders
+
+
+EPOCHS = 10
+BATCH_SIZE = 16
+LR = 1e-5
+WEIGHT_DECAY = 0.01
+THRESHOLD = 0.55
+CHECKPOINT = "best_model.pt"
+DEVICE = torch.device("cuda" if torch.cuda.is_available() else "cpu")
+EARLY_STOPPING_PATIENCE = 4
+FREEZE_BERT_LAYERS = 0  # Unfrozen all layers for deep fine-tuning on diverse data
+LABEL_SMOOTHING = 0.05
+
+
+class LabelSmoothingBCELoss(nn.Module):
+    """BCE with logits, class weighting, and mild label smoothing."""
+    def __init__(self, pos_weight: torch.Tensor, smoothing: float = 0.05):
+        super().__init__()
+        self.pos_weight = pos_weight
+        self.smoothing = smoothing
+
+    def forward(self, logits: torch.Tensor, targets: torch.Tensor) -> torch.Tensor:
+        targets_smooth = targets * (1 - self.smoothing) + self.smoothing * 0.5
+        return nn.functional.binary_cross_entropy_with_logits(
+            logits, targets_smooth, pos_weight=self.pos_weight
+        )
+
+
+def train_epoch(model, loader, criterion, optimizer, scheduler):
+    model.train()
+    total_loss = 0
+    all_preds = []
+    all_labels = []
+
+    for batch in loader:
+        input_ids = batch['input_ids'].to(DEVICE)
+        attention_mask = batch['attention_mask'].to(DEVICE)
+        hand_features = batch['hand_features'].to(DEVICE)
+        labels = batch['label'].to(DEVICE)
+
+        optimizer.zero_grad()
+        logits = model(input_ids, attention_mask, hand_features)
+        loss = criterion(logits, labels)
+        loss.backward()
+
+        torch.nn.utils.clip_grad_norm_(model.parameters(), 1.0)
+        optimizer.step()
+        scheduler.step()
+
+        total_loss += loss.item()
+        preds = (torch.sigmoid(logits) > THRESHOLD).long().cpu().tolist()
+        all_preds.extend(preds)
+        all_labels.extend(labels.long().cpu().tolist())
+
+    avg_loss = total_loss / len(loader)
+    acc = accuracy_score(all_labels, all_preds)
+    prec = precision_score(all_labels, all_preds, zero_division=0)
+    rec = recall_score(all_labels, all_preds, zero_division=0)
+    f1 = f1_score(all_labels, all_preds, zero_division=0)
+
+    return avg_loss, acc, prec, rec, f1
+
+
+def evaluate(model, loader, criterion):
+    model.eval()
+    total_loss = 0
+    all_preds = []
+    all_labels = []
+
+    with torch.no_grad():
+        for batch in loader:
+            input_ids = batch['input_ids'].to(DEVICE)
+            attention_mask = batch['attention_mask'].to(DEVICE)
+            hand_features = batch['hand_features'].to(DEVICE)
+            labels = batch['label'].to(DEVICE)
+
+            logits = model(input_ids, attention_mask, hand_features)
+            loss = criterion(logits, labels)
+
+            total_loss += loss.item()
+            preds = (torch.sigmoid(logits) > THRESHOLD).long().cpu().tolist()
+            all_preds.extend(preds)
+            all_labels.extend(labels.long().cpu().tolist())
+
+    avg_loss = total_loss / len(loader)
+    acc = accuracy_score(all_labels, all_preds)
+    prec = precision_score(all_labels, all_preds, zero_division=0)
+    rec = recall_score(all_labels, all_preds, zero_division=0)
+    f1 = f1_score(all_labels, all_preds, zero_division=0)
+
+    return avg_loss, acc, prec, rec, f1, all_preds, all_labels
+
+
+def main():
+    print(f"Using device: {DEVICE}")
+
+    print("Loading dataset...")
+    df = load_dataset()
+
+    train_df, val_df, test_df = split_dataset(df)
+    print(f"Train: {len(train_df)}, Val: {len(val_df)}, Test: {len(test_df)}")
+
+    print("Loading tokenizer and building dataloaders...")
+    tokenizer = get_tokenizer()
+    train_loader, val_loader, test_loader, norm_stats = build_dataloaders(train_df, val_df, test_df, tokenizer, BATCH_SIZE)
+
+    print("Initializing model...")
+    model = SmishingDetector(num_handcrafted=17, dropout=0.3, freeze_bert_layers=FREEZE_BERT_LAYERS).to(DEVICE)
+
+    spam_count = train_df['label'].sum()
+    ham_count = len(train_df) - spam_count
+    pos_weight = torch.tensor([ham_count / spam_count]).to(DEVICE)
+    print(f"Class imbalance - pos_weight: {pos_weight.item():.2f}")
+
+    criterion = LabelSmoothingBCELoss(pos_weight=pos_weight, smoothing=LABEL_SMOOTHING)
+
+    trainable_params = [p for p in model.parameters() if p.requires_grad]
+    optimizer = AdamW(trainable_params, lr=LR, weight_decay=WEIGHT_DECAY)
+
+    total_steps = len(train_loader) * EPOCHS
+    warmup_steps = total_steps // 10
+    scheduler = get_linear_schedule_with_warmup(optimizer, warmup_steps, total_steps)
+
+    best_val_f1 = 0.0
+    patience_counter = 0
+
+    print(f"\nStarting training ({EPOCHS} epochs, early stopping patience={EARLY_STOPPING_PATIENCE})...")
+    for epoch in range(EPOCHS):
+        train_loss, train_acc, train_prec, train_rec, train_f1 = train_epoch(
+            model, train_loader, criterion, optimizer, scheduler
+        )
+
+        val_loss, val_acc, val_prec, val_rec, val_f1, _, _ = evaluate(model, val_loader, criterion)
+
+        print(f"Epoch {epoch+1}/{EPOCHS}")
+        print(f"  Train - Loss: {train_loss:.4f}, Acc: {train_acc:.4f}, Prec: {train_prec:.4f}, Rec: {train_rec:.4f}, F1: {train_f1:.4f}")
+        print(f"  Val   - Loss: {val_loss:.4f}, Acc: {val_acc:.4f}, Prec: {val_prec:.4f}, Rec: {val_rec:.4f}, F1: {val_f1:.4f}")
+
+        if val_f1 > best_val_f1:
+            best_val_f1 = val_f1
+            patience_counter = 0
+            torch.save({
+                'epoch': epoch,
+                'model_state': model.state_dict(),
+                'val_f1': best_val_f1,
+                'threshold': THRESHOLD,
+                'feature_mins': norm_stats['feature_mins'].tolist(),
+                'feature_ranges': norm_stats['feature_ranges'].tolist(),
+            }, CHECKPOINT)
+            print(f"  -> New best model saved (F1: {best_val_f1:.4f})")
+        else:
+            patience_counter += 1
+            print(f"  -> No improvement ({patience_counter}/{EARLY_STOPPING_PATIENCE})")
+            if patience_counter >= EARLY_STOPPING_PATIENCE:
+                print(f"\nEarly stopping triggered after {epoch+1} epochs")
+                break
+
+    print("\nLoading best model for test evaluation...")
+    checkpoint = torch.load(CHECKPOINT, map_location=DEVICE, weights_only=False)
+    model.load_state_dict(checkpoint['model_state'])
+
+    test_loss, test_acc, test_prec, test_rec, test_f1, test_preds, test_labels = evaluate(model, test_loader, criterion)
+
+    print("\n" + "="*60)
+    print("TEST SET RESULTS")
+    print("="*60)
+    print(f"Loss: {test_loss:.4f}, Accuracy: {test_acc:.4f}")
+    print(f"Precision: {test_prec:.4f}, Recall: {test_rec:.4f}, F1: {test_f1:.4f}")
+
+    print("\nClassification Report:")
+    print(classification_report(test_labels, test_preds, target_names=['ham', 'spam']))
+
+    cm = confusion_matrix(test_labels, test_preds)
+    print("Confusion Matrix:")
+    print(cm)
+
+    fpr = cm[0][1] / (cm[0][0] + cm[0][1]) if (cm[0][0] + cm[0][1]) > 0 else 0
+    fnr = cm[1][0] / (cm[1][0] + cm[1][1]) if (cm[1][0] + cm[1][1]) > 0 else 0
+
+    print(f"False Positive Rate: {fpr:.4f} (ham flagged as spam)")
+    print(f"False Negative Rate: {fnr:.4f} (spam missed)")
+
+    print("\nTraining complete!")
+
+
+if __name__ == "__main__":
+    main()

smishing_detector/utils/data_loader.py

@@ -0,0 +1,403 @@
+"""
+Dataset and feature engine for ScamShield.
+
+Feature extraction is deterministic and side-effect free. In particular, it does
+not call Google Safe Browsing or any network service. Training, evaluation, and
+inference all import the same functions from this module.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from pathlib import Path
+from typing import Iterable, Optional
+
+import numpy as np
+import pandas as pd
+import tldextract
+from sklearn.model_selection import train_test_split
+
+
+BASE_DIR = Path(__file__).resolve().parents[1]
+DATA_DIR = BASE_DIR / "data"
+
+SUSPICIOUS_TLDS = {
+    "tk", "ml", "ga", "cf", "gq", "xyz", "top", "click", "link",
+    "work", "loan", "online", "site", "info", "biz", "club",
+}
+
+URL_SHORTENERS = {
+    "bit.ly", "tinyurl.com", "t.co", "goo.gl", "ow.ly", "is.gd",
+    "buff.ly", "rebrand.ly", "cutt.ly", "fkrt.it", "amzn.in",
+}
+
+LEGIT_DOMAINS = {
+    "amazon.com", "amazon.in", "netflix.com", "spotify.com", "apple.com",
+    "google.com", "microsoft.com", "paypal.com", "ebay.com", "walmart.com",
+    "fedex.com", "ups.com", "usps.com", "shopify.com", "slack.com",
+    "zoom.us", "gmail.com", "outlook.com", "yahoo.com",
+    "flipkart.com", "myntra.com", "swiggy.com", "zomato.com",
+    "makemytrip.com", "yatra.com", "cleartrip.com", "paytm.com",
+    "phonepe.com", "hdfcbank.com", "onlinesbi.sbi", "icicibank.com",
+    "axisbank.com", "kotak.com", "airindia.in", "goindigo.in",
+    "irctc.co.in", "redbus.in", "olacabs.com", "hotstar.com",
+    "sonyliv.com", "zee5.com", "jiocinema.com", "moneycontrol.com",
+    "bseindia.com", "nseindia.com", "bookmyshow.com", "policybazaar.com",
+    "nykaa.com", "ajio.com", "firstcry.com", "bigbasket.com",
+    "blinkit.com", "zepto.com", "upstox.com", "groww.in", "zerodha.com",
+    "airtel.in", "jio.com", "myvi.in", "vi.com", "bsnl.co.in",
+    "tataplay.com", "dishtv.in", "sbicard.com", "bajajfinserv.in",
+    "cred.club", "licindia.in", "epfindia.gov.in", "mseb.co.in",
+    "bescom.org", "uidai.gov.in", "cibil.com",
+}
+
+TRUSTED_TLDS = {
+    "gov", "gov.in", "edu", "sbi",
+}
+
+URL_FEATURE_COLS = [
+    "has_url", "num_urls", "has_http", "has_https", "suspicious_tld",
+    "max_url_len", "has_ip_url", "has_shortened_url", "has_legit_domain",
+]
+
+TEXT_FEATURE_COLS = [
+    "num_chars", "num_words", "pct_upper", "pct_digits", "num_special",
+    "urgency_count", "has_phone", "has_currency",
+]
+
+URGENCY_WORDS = {
+    "urgent", "winner", "won", "free", "prize", "claim", "cash",
+    "congratulations", "selected", "reward", "limited", "click",
+    "password", "invoice", "crypto", "bitcoin", "wallet", "suspended",
+    "blocked", "deactivated", "illegal", "arrested", "cyber", "fraud",
+    "hack", "jaldi", "turant", "abhi", "kijiye", "rupaye", "paisa",
+    "khata", "band", "inam", "jeeta", "loot", "kyc", "cashback",
+    "lucky", "gift", "redeem", "bijli", "officer", "helpline",
+    "fir", "giraftari", "arrest",
+}
+
+URGENCY_PHRASES = {
+    "act now", "action required", "share your otp", "last chance",
+    "court notice", "turant call", "abhi call", "aaj raat",
+    "kal subah", "power cut", "connection cut", "band ho jayega",
+}
+
+CURRENCY_SYMBOLS = {"$", "\u00a3", "\u20ac", "\u20b9", "btc", "eth", "usdt"}
+
+INDIAN_LEGIT_SMS = [
+    "HDFC Bank: Rs.25,000 credited to a/c XX4521 on 02-May. Avl bal: Rs.1,42,356. -HDFC Bank",
+    "Dear Customer, your ICICI a/c ending 7890 debited Rs.1,500 at AMAZON on 01-May. -ICICI Bank",
+    "Your SBI a/c XXXX1234 is credited with INR 5,000.00 on 01-May-25. Bal: INR 12,450.00. -SBI",
+    "Your OTP for SBI Net Banking login is 483921. Valid for 10 minutes. Do not share. -SBI",
+    "PhonePe OTP: 273948 for payment of Rs.150 to Zomato. Do not share. -PhonePe",
+    "Aadhaar OTP: 581234 for e-KYC verification. Valid 30 minutes. -UIDAI",
+    "Airtel Thanks! Your recharge of Rs.239 is successful. Validity: 28 days. Data: 1.5GB/day. -Airtel",
+    "Jio: Your recharge of Rs.299 is done. Validity 28 days, 2GB/day data. Enjoy! -Jio",
+    "Your electricity bill of Rs.1,234 for account 98765 is due on 10-May. Pay via BESCOM app.",
+    "Bijli Bill: Aapka MSEB bijli bill Rs.1,847 generate ho gaya hai. Due date: 10-Jun-26. Pay at mseb.co.in",
+    "Your Amazon order #402-9876543 is out for delivery today. Track: amzn.in/track -Amazon",
+    "Flipkart: Your order for boAt Earphones has been shipped. Tracking: fkrt.it/xyz -Flipkart",
+    "Zomato: Your order from Dominos has been picked up. ETA: 25 mins. -Zomato",
+    "Your IRCTC ticket PNR 4567891230 is confirmed. Train 12345 on 05-May. Seat: S4/32. -IRCTC",
+    "IndiGo: Your flight 6E-456 on 05-May is confirmed. PNR: ABCDEF. Web check-in open. -IndiGo",
+    "LIC: Your premium of Rs.5,000 for policy 123456789 is due on 10-May. Pay at licindia.in.",
+    "EPFO: Your PF balance as of 01-May-25 is Rs.2,45,678. Check on epfindia.gov.in. -EPFO",
+    "You received Rs.500 from Priya via UPI. UPI Ref: 123456789012. -Google Pay",
+    "PhonePe: Rs.1,200 sent to Ajay Kumar successfully. UPI Ref: 987654321. -PhonePe",
+    "Paytm: Rs.250 added to your wallet from HDFC Bank XX1234. Wallet Bal: Rs.430. -Paytm",
+]
+
+URL_RE = re.compile(r"(?:https?://|www\.)[^\s<>'\"]+", re.IGNORECASE)
+BARE_DOMAIN_RE = re.compile(
+    r"\b(?:[a-zA-Z0-9-]+\.)+(?:com|org|net|edu|gov|gov\.in|co\.uk|co\.in|in|io|co|sbi|club|xyz|top|click|link|online|site|info|biz)\b",
+    re.IGNORECASE,
+)
+PHONE_RE = re.compile(r"(?:\+91[-\s]?)?\d[\d\s-]{8,}\d")
+TOKEN_RE = re.compile(r"[a-z]+|[\u0900-\u097F]+")
+
+
+def get_feature_columns() -> list[str]:
+    return URL_FEATURE_COLS + TEXT_FEATURE_COLS
+
+
+def clean_text(text: str, remove_urls: bool = False) -> str:
+    text = "" if text is None else str(text)
+    if remove_urls:
+        text = URL_RE.sub("", text)
+    return re.sub(r"\s+", " ", text).strip()
+
+
+def extract_urls(text: str) -> list[str]:
+    text = "" if text is None else str(text)
+    urls = URL_RE.findall(text)
+    urls.extend(BARE_DOMAIN_RE.findall(text))
+    cleaned = []
+    for url in urls:
+        cleaned.append(url.strip(".,;:!?)\"]}'").lower())
+    return sorted(set(u for u in cleaned if u))
+
+
+def _registered_domain(url: str) -> tuple[str, str]:
+    ext = tldextract.extract(url)
+    domain = ext.domain.lower()
+    suffix = ext.suffix.lower()
+    full_domain = f"{domain}.{suffix}".strip(".")
+    return full_domain, suffix
+
+
+def url_features(text: str) -> dict:
+    urls = extract_urls(text)
+
+    suspicious_tld = 0
+    has_ip_url = 0
+    has_shortened_url = 0
+    has_legit_domain = 0
+    max_url_len = 0
+
+    for url in urls:
+        max_url_len = max(max_url_len, len(url))
+        full_domain, suffix = _registered_domain(url)
+
+        if suffix in SUSPICIOUS_TLDS:
+            suspicious_tld = 1
+        if full_domain in URL_SHORTENERS:
+            has_shortened_url = 1
+        if full_domain in LEGIT_DOMAINS or suffix in TRUSTED_TLDS:
+            has_legit_domain = 1
+        if re.search(r"https?://\d{1,3}(?:\.\d{1,3}){3}", url, re.IGNORECASE):
+            has_ip_url = 1
+
+    return {
+        "has_url": int(bool(urls)),
+        "num_urls": len(urls),
+        "has_http": int(any(u.startswith("http://") for u in urls)),
+        "has_https": int(any(u.startswith("https://") for u in urls)),
+        "suspicious_tld": suspicious_tld,
+        "max_url_len": max_url_len,
+        "has_ip_url": has_ip_url,
+        "has_shortened_url": has_shortened_url,
+        "has_legit_domain": has_legit_domain,
+    }
+
+
+def text_features(text: str) -> dict:
+    text = "" if text is None else str(text)
+    lowered = text.lower()
+    tokens = TOKEN_RE.findall(lowered)
+
+    num_chars = len(text)
+    upper_count = sum(1 for c in text if c.isupper())
+    digit_count = sum(1 for c in text if c.isdigit())
+    special_count = sum(1 for c in text if c in "!@#$%^&*()_+-=[]{}|;:,.<>?")
+    urgency_count = sum(1 for token in tokens if token in URGENCY_WORDS)
+    urgency_count += sum(1 for phrase in URGENCY_PHRASES if phrase in lowered)
+
+    return {
+        "num_chars": num_chars,
+        "num_words": len(tokens),
+        "pct_upper": upper_count / num_chars if num_chars else 0.0,
+        "pct_digits": digit_count / num_chars if num_chars else 0.0,
+        "num_special": special_count,
+        "urgency_count": urgency_count,
+        "has_phone": int(bool(PHONE_RE.search(text))),
+        "has_currency": int(any(symbol in lowered for symbol in CURRENCY_SYMBOLS)),
+    }
+
+
+def _standardize_label(value) -> Optional[int]:
+    if value is None or (isinstance(value, float) and np.isnan(value)):
+        return None
+    text = str(value).strip().lower()
+    mapping = {
+        "spam": 1, "scam": 1, "phishing": 1, "smishing": 1, "1": 1, "true": 1,
+        "ham": 0, "safe": 0, "legit": 0, "legitimate": 0, "not_spam": 0,
+        "0": 0, "false": 0,
+    }
+    return mapping.get(text)
+
+
+def _standardize_frame(df: pd.DataFrame, message_cols: Iterable[str], label_cols: Iterable[str]) -> pd.DataFrame:
+    lower_map = {c.lower().strip(): c for c in df.columns}
+    msg_col = next((lower_map[c] for c in message_cols if c in lower_map), None)
+    lbl_col = next((lower_map[c] for c in label_cols if c in lower_map), None)
+
+    if msg_col is None or lbl_col is None:
+        return pd.DataFrame(columns=["message", "label"])
+
+    result = pd.DataFrame({
+        "message": df[msg_col].astype(str),
+        "label": df[lbl_col].apply(_standardize_label),
+    })
+    result = result.dropna(subset=["message", "label"])
+    result["label"] = result["label"].astype(int)
+    result = result[result["message"].str.strip() != ""]
+    return result[["message", "label"]].reset_index(drop=True)
+
+
+def _load_local_spam_csv() -> pd.DataFrame:
+    path = DATA_DIR / "spam.csv"
+    if not path.exists():
+        return pd.DataFrame(columns=["message", "label"])
+    try:
+        df = pd.read_csv(path, encoding="latin-1")
+        result = _standardize_frame(df, ["v2", "message", "text", "sms"], ["v1", "label", "labels", "category"])
+        print(f"  Local UCI spam.csv: {len(result)} messages loaded")
+        return result
+    except Exception as exc:
+        print(f"  Warning: failed to load local spam.csv: {exc}")
+        return pd.DataFrame(columns=["message", "label"])
+
+
+def _load_local_parquet() -> pd.DataFrame:
+    frames = []
+    for path in sorted(DATA_DIR.glob("*.parquet")):
+        try:
+            raw = pd.read_parquet(path)
+            result = _standardize_frame(raw, ["message", "text", "sms", "email"], ["label", "labels", "category", "class"])
+            if len(result):
+                print(f"  Local {path.name}: {len(result)} messages loaded")
+                frames.append(result)
+        except Exception as exc:
+            print(f"  Warning: failed to load {path.name}: {exc}")
+    if not frames:
+        return pd.DataFrame(columns=["message", "label"])
+    return pd.concat(frames, ignore_index=True)
+
+
+def _load_synthetic_indian_legit() -> pd.DataFrame:
+    print(f"  Synthetic Indian legit SMS: {len(INDIAN_LEGIT_SMS)} messages loaded")
+    return pd.DataFrame({"message": INDIAN_LEGIT_SMS, "label": 0})
+
+
+def _load_huggingface_dataset(name: str) -> pd.DataFrame:
+    try:
+        from datasets import load_dataset as hf_load
+
+        ds = hf_load(name)
+        frames = []
+        for split_name in ds.keys():
+            raw = ds[split_name].to_pandas()
+            frames.append(_standardize_frame(raw, ["message", "text", "sms", "email"], ["label", "labels", "category", "class"]))
+        result = pd.concat(frames, ignore_index=True)
+        print(f"  HuggingFace {name}: {len(result)} messages loaded")
+        return result
+    except Exception as exc:
+        print(f"  Warning: failed to load HuggingFace {name}: {exc}")
+        return pd.DataFrame(columns=["message", "label"])
+
+
+def _load_multilingual_hf(name: str) -> pd.DataFrame:
+    try:
+        from datasets import load_dataset as hf_load
+
+        ds = hf_load(name)
+        raw = pd.concat([ds[s].to_pandas() for s in ds.keys()], ignore_index=True)
+        lower_map = {c.lower().strip(): c for c in raw.columns}
+        label_col = next((lower_map[c] for c in ["label", "labels", "v1", "category", "class"] if c in lower_map), None)
+        if label_col is None:
+            return pd.DataFrame(columns=["message", "label"])
+
+        message_cols = []
+        for col in raw.columns:
+            lower = col.lower().strip()
+            if lower in {"text", "message", "sms", "v2", "text_en", "en", "text_hi", "hi", "hindi"} or lower.endswith("_hi"):
+                message_cols.append(col)
+
+        frames = []
+        for col in message_cols:
+            frame = pd.DataFrame({"message": raw[col].astype(str), "label": raw[label_col].apply(_standardize_label)})
+            frame = frame.dropna(subset=["message", "label"])
+            frame["label"] = frame["label"].astype(int)
+            frame = frame[frame["message"].str.strip() != ""]
+            frames.append(frame[["message", "label"]])
+
+        result = pd.concat(frames, ignore_index=True) if frames else pd.DataFrame(columns=["message", "label"])
+        print(f"  Multilingual {name}: {len(result)} messages loaded")
+        return result
+    except Exception as exc:
+        print(f"  Warning: failed to load multilingual {name}: {exc}")
+        return pd.DataFrame(columns=["message", "label"])
+
+
+def _deduplicate(df: pd.DataFrame) -> pd.DataFrame:
+    df = df.copy()
+    df["_norm"] = df["message"].astype(str).str.lower().str.strip().str.replace(r"\s+", " ", regex=True)
+    df = df.drop_duplicates(subset="_norm", keep="first").drop(columns=["_norm"])
+    return df.reset_index(drop=True)
+
+
+def _add_features(df: pd.DataFrame) -> pd.DataFrame:
+    url_rows = []
+    text_rows = []
+    cleaned = []
+
+    for message in df["message"]:
+        message = str(message)
+        url_rows.append(url_features(message))
+        text_rows.append(text_features(message))
+        cleaned.append(clean_text(message))
+
+    result = pd.concat(
+        [df.reset_index(drop=True), pd.DataFrame(url_rows), pd.DataFrame(text_rows)],
+        axis=1,
+    )
+    result["message"] = cleaned
+    return result
+
+
+def load_dataset(use_remote: Optional[bool] = None) -> pd.DataFrame:
+    """
+    Load SMS datasets and return message, label, and feature columns.
+
+    Remote loaders are enabled by default. Set SCAMSHIELD_USE_REMOTE_DATA=0 or
+    pass use_remote=False to train only on local files plus synthetic examples.
+    """
+    if use_remote is None:
+        use_remote = os.getenv("SCAMSHIELD_USE_REMOTE_DATA", "1").lower() not in {"0", "false", "no"}
+
+    print("Loading datasets...")
+    frames = [
+        _load_local_spam_csv(),
+        _load_local_parquet(),
+        _load_synthetic_indian_legit(),
+    ]
+
+    if use_remote:
+        frames.extend([
+            _load_huggingface_dataset("Deysi/spam-detection-dataset"),
+            _load_huggingface_dataset("Ngadou/Spam_SMS"),
+            _load_multilingual_hf("dbarbedillo/SMS_Spam_Multilingual_Collection_Dataset"),
+        ])
+
+    frames = [frame for frame in frames if len(frame) > 0]
+    if not frames:
+        raise RuntimeError("No datasets loaded. Check local data files or enable remote datasets.")
+
+    df = pd.concat(frames, ignore_index=True)
+    before = len(df)
+    df = _deduplicate(df)
+    if before != len(df):
+        print(f"  Removed {before - len(df)} duplicate messages")
+
+    df = _add_features(df)
+    spam_count = int(df["label"].sum())
+    ham_count = len(df) - spam_count
+    print(f"\nDataset loaded: {len(df)} messages ({spam_count} spam, {ham_count} ham)")
+    return df
+
+
+def split_dataset(df: pd.DataFrame, seed: int = 42) -> tuple[pd.DataFrame, pd.DataFrame, pd.DataFrame]:
+    train_df, temp_df = train_test_split(
+        df,
+        test_size=0.30,
+        stratify=df["label"],
+        random_state=seed,
+    )
+    val_df, test_df = train_test_split(
+        temp_df,
+        test_size=0.50,
+        stratify=temp_df["label"],
+        random_state=seed,
+    )
+    return train_df.reset_index(drop=True), val_df.reset_index(drop=True), test_df.reset_index(drop=True)

smishing_detector/utils/encryption.py

@@ -0,0 +1,82 @@
+"""
+utils/encryption.py — AES-256-CBC encrypt/decrypt for secure API communication.
+
+Shared key is stored in .env as SMS_ENCRYPTION_KEY (64-char hex = 32 bytes).
+Mobile encrypts SMS body with the same key before sending to /predict_secure.
+"""
+
+import os
+import base64
+import secrets
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.backends import default_backend
+from dotenv import load_dotenv
+
+load_dotenv()
+
+# 32-byte (256-bit) key from env — generate once with:
+#   python -c "import os; print(os.urandom(32).hex())"
+def _load_key_hex() -> str:
+    key_hex = os.getenv("SMS_ENCRYPTION_KEY")
+    if not key_hex:
+        # Fallback to known default so mobile and server stay in sync
+        # when .env is not yet configured. Set SMS_ENCRYPTION_KEY in .env
+        # before deploying to production.
+        key_hex = "5fc5555dfd4b23ecfbfbfda273cb82eb5fdfb8b25c5b1357a2568d6afa1f472e"
+        print("Warning: SMS_ENCRYPTION_KEY not set in .env; using built-in dev key.")
+    if len(key_hex) != 64:
+        raise ValueError("SMS_ENCRYPTION_KEY must be a 64-character hex string.")
+    bytes.fromhex(key_hex)  # validate it's valid hex
+    return key_hex
+
+
+_KEY_HEX = _load_key_hex()
+
+
+def get_key() -> bytes:
+    return bytes.fromhex(_KEY_HEX)
+
+
+def decrypt_message(encrypted_b64: str) -> str:
+    """
+    Decrypt a base64-encoded AES-256-CBC ciphertext.
+    Format: base64(IV[16] + ciphertext)
+    Matching encrypt_message() in mobile src/utils/encryption.js
+    """
+    data = base64.b64decode(encrypted_b64)
+    iv         = data[:16]
+    ciphertext = data[16:]
+    key        = get_key()
+
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
+    decryptor = cipher.decryptor()
+    padded = decryptor.update(ciphertext) + decryptor.finalize()
+
+    # Remove PKCS7 padding
+    pad_len = padded[-1]
+    return padded[:-pad_len].decode("utf-8")
+
+
+def encrypt_message(plaintext: str) -> str:
+    """
+    Encrypt a string with AES-256-CBC (for testing / server-to-client responses).
+    Returns base64(IV[16] + ciphertext).
+    """
+    key = get_key()
+    iv  = secrets.token_bytes(16)
+
+    # PKCS7 padding
+    raw = plaintext.encode("utf-8")
+    pad = 16 - (len(raw) % 16)
+    raw += bytes([pad] * pad)
+
+    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
+    encryptor = cipher.encryptor()
+    ciphertext = encryptor.update(raw) + encryptor.finalize()
+
+    return base64.b64encode(iv + ciphertext).decode("utf-8")
+
+
+def get_key_hex() -> str:
+    """Return current key as hex — sent to client on /api/encryption-key."""
+    return _KEY_HEX

smishing_detector/utils/multilingual_loader.py

@@ -0,0 +1,206 @@
+"""
+utils/multilingual_loader.py
+-----------------------------
+Loads Hindi and Hinglish test datasets for multilingual evaluation.
+Used ONLY for evaluation — not added to training data.
+"""
+
+import pandas as pd
+import numpy as np
+import re
+from datasets import load_dataset as hf_load
+
+
+def detect_language(text: str) -> str:
+    """
+    Detect if a message is:
+    - 'hindi'   : contains Devanagari Unicode characters (pure Hindi)
+    - 'hinglish': Roman script with Hindi words mixed with English
+    - 'english' : standard English
+    """
+    # Check for Devanagari Unicode range (0900-097F)
+    devanagari_pattern = re.compile(r'[\u0900-\u097F]')
+    if devanagari_pattern.search(text):
+        return 'hindi'
+
+    # Common Hinglish words that appear in Roman script
+    hinglish_markers = {
+        'aapka', 'aapke', 'abhi', 'karo', 'kare', 'kiya', 'nahi', 'nai',
+        'hai', 'hain', 'ho', 'ka', 'ki', 'ke', 'ko', 'se', 'mein', 'par',
+        'aur', 'bhi', 'yeh', 'woh', 'ap', 'apka', 'jana', 'karna', 'dena',
+        'lena', 'milega', 'milegi', 'paisa', 'rupaye', 'khata', 'band',
+        'verify', 'kijiye', 'dijiye', 'lijiye', 'phir', 'agar', 'toh',
+        'jaldi', 'turant', 'abhi', 'sirf', 'bahut', 'accha', 'theek'
+    }
+    words = set(text.lower().split())
+    if len(words.intersection(hinglish_markers)) >= 2:
+        return 'hinglish'
+
+    return 'english'
+
+
+def load_hindi_test_data() -> pd.DataFrame:
+    """
+    Load Hindi (Devanagari) test data from HuggingFace multilingual dataset.
+    Returns DataFrame with columns: message, label, language
+    """
+    print("Loading Hindi test data from HuggingFace...")
+    try:
+        ds = hf_load("dbarbedillo/SMS_Spam_Multilingual_Collection_Dataset")
+
+        dfs = []
+        for split_name in ds.keys():
+            split_df = ds[split_name].to_pandas()
+            dfs.append(split_df)
+        df = pd.concat(dfs, ignore_index=True)
+
+        # This dataset has columns for each language
+        # Find the Hindi column
+        hindi_col = None
+        for col in df.columns:
+            if 'hindi' in col.lower() or 'hi' == col.lower():
+                hindi_col = col
+                break
+
+        if hindi_col is None:
+            # Try text_hi column (actual name in this dataset)
+            if 'text_hi' in df.columns:
+                hindi_col = 'text_hi'
+            else:
+                # Auto-detect by Devanagari content
+                skip = {'label', 'labels', 'v1', 'v2'}
+                for col in df.columns:
+                    if col in skip:
+                        continue
+                    sample = df[col].dropna().head(10).astype(str)
+                    devanagari = re.compile(r'[\u0900-\u097F]')
+                    if any(devanagari.search(s) for s in sample):
+                        hindi_col = col
+                        break
+
+        if hindi_col is None:
+            print("  Warning: Could not find Hindi column")
+            return pd.DataFrame(columns=['message', 'label', 'language'])
+
+        # Get label column — could be 'v1', 'label', or 'labels' (case-insensitive)
+        col_lower_map = {c.lower().strip(): c for c in df.columns}
+        label_col = next((col_lower_map[c] for c in ['v1', 'label', 'labels'] if c in col_lower_map), None)
+        if label_col is None:
+            print(f"  Warning: No label column found. Got: {df.columns.tolist()}")
+            return pd.DataFrame(columns=['message', 'label', 'language'])
+
+        result_df = pd.DataFrame({
+            'message': df[hindi_col].astype(str),
+            'label': df[label_col]
+        })
+
+        # Standardise labels
+        label_map = {'ham': 0, 'spam': 1, 0: 0, 1: 1, '0': 0, '1': 1}
+        result_df['label'] = result_df['label'].map(label_map)
+        result_df = result_df.dropna(subset=['message', 'label'])
+        result_df['label'] = result_df['label'].astype(int)
+        result_df['language'] = 'hindi'
+
+        print(f"  Hindi test data: {len(result_df)} messages "
+              f"({result_df['label'].sum()} spam, "
+              f"{(result_df['label']==0).sum()} ham)")
+        return result_df.reset_index(drop=True)
+
+    except Exception as e:
+        print(f"  Warning: Failed to load Hindi data: {e}")
+        return pd.DataFrame(columns=['message', 'label', 'language'])
+
+
+def load_hinglish_test_data() -> pd.DataFrame:
+    """
+    Load Hinglish test data from Kaggle multilingual spam dataset.
+    Returns DataFrame with columns: message, label, language
+    """
+    print("Loading Hinglish test data from Kaggle...")
+    try:
+        import kagglehub
+        path = kagglehub.dataset_download("rajnathpatel/multilingual-spam-data")
+
+        import os
+        csv_files = [f for f in os.listdir(path) if f.endswith('.csv')]
+        if not csv_files:
+            print("  Warning: No CSV files in Kaggle multilingual dataset")
+            return pd.DataFrame(columns=['message', 'label', 'language'])
+
+        dfs = []
+        for csv_file in csv_files:
+            try:
+                df = pd.read_csv(f"{path}/{csv_file}", encoding='latin-1')
+                dfs.append(df)
+            except Exception:
+                continue
+
+        if not dfs:
+            return pd.DataFrame(columns=['message', 'label', 'language'])
+
+        df = pd.concat(dfs, ignore_index=True)
+
+        # Standardise column names
+        col_lower = {c: c.lower().strip() for c in df.columns}
+        df = df.rename(columns=col_lower)
+
+        # Find message and label columns
+        msg_col = next((c for c in df.columns if c in ['text', 'message', 'sms', 'v2']), None)
+        lbl_col = next((c for c in ['label', 'labels', 'v1', 'category', 'class'] if c in df.columns), None)
+
+        if not msg_col or not lbl_col:
+            print(f"  Warning: Could not identify columns. Found: {df.columns.tolist()}")
+            return pd.DataFrame(columns=['message', 'label', 'language'])
+
+        result_df = pd.DataFrame({
+            'message': df[msg_col].astype(str),
+            'label': df[lbl_col]
+        })
+
+        label_map = {'ham': 0, 'spam': 1, 0: 0, 1: 1, '0': 0, '1': 1}
+        result_df['label'] = result_df['label'].map(label_map)
+        result_df = result_df.dropna(subset=['message', 'label'])
+        result_df['label'] = result_df['label'].astype(int)
+
+        # Detect language per message and keep only Hindi/Hinglish
+        result_df['language'] = result_df['message'].apply(detect_language)
+        result_df = result_df[result_df['language'].isin(['hindi', 'hinglish'])]
+
+        print(f"  Hinglish/Hindi test data: {len(result_df)} messages "
+              f"({result_df['label'].sum()} spam, "
+              f"{(result_df['label']==0).sum()} ham)")
+        return result_df.reset_index(drop=True)
+
+    except Exception as e:
+        print(f"  Warning: Failed to load Hinglish data: {e}")
+        return pd.DataFrame(columns=['message', 'label', 'language'])
+
+
+def load_all_multilingual_test_data() -> dict[str, pd.DataFrame]:
+    """
+    Loads all multilingual test data.
+    Returns dict with keys: 'hindi', 'hinglish', 'combined'
+    """
+    hindi_df = load_hindi_test_data()
+    hinglish_df = load_hinglish_test_data()
+
+    # Separate hinglish from hindi in the combined df
+    pure_hindi = pd.concat([
+        hindi_df,
+        hinglish_df[hinglish_df['language'] == 'hindi']
+    ], ignore_index=True)
+
+    pure_hinglish = hinglish_df[hinglish_df['language'] == 'hinglish'].reset_index(drop=True)
+
+    combined = pd.concat([pure_hindi, pure_hinglish], ignore_index=True)
+
+    print(f"\nTotal multilingual test data:")
+    print(f"  Pure Hindi:  {len(pure_hindi)} messages")
+    print(f"  Hinglish:    {len(pure_hinglish)} messages")
+    print(f"  Combined:    {len(combined)} messages")
+
+    return {
+        'hindi': pure_hindi,
+        'hinglish': pure_hinglish,
+        'combined': combined
+    }

smishing_detector/utils/safe_browsing.py

@@ -0,0 +1,208 @@
+"""Google Safe Browsing API integration for domain legitimacy checking."""
+
+import os
+import time
+import requests
+from typing import Optional, Dict
+from dotenv import load_dotenv
+
+# Load .env file from project root
+load_dotenv()
+
+
+# Google Safe Browsing API v4 endpoint
+SAFE_BROWSING_API_URL = "https://safebrowsing.googleapis.com/v4/threatMatches:find"
+
+# Threat types to check for
+THREAT_TYPES = ["MALWARE", "SOCIAL_ENGINEERING", "UNWANTED_SOFTWARE", "POTENTIALLY_HARMFUL_APPLICATION"]
+
+# Platform types - use ANY_PLATFORM to check all platforms
+PLATFORM_TYPES = ["ANY_PLATFORM"]
+
+
+class SafeBrowsingChecker:
+    """Wrapper for Google Safe Browsing API with caching and fallback logic."""
+    
+    def __init__(self):
+        """Initialize the Safe Browsing checker."""
+        self.api_key = os.getenv("GOOGLE_SAFE_BROWSING_API_KEY")
+        self.cache: Dict[str, str] = {}  # domain -> known_safe | known_malicious | unknown
+        self.cache_timestamps: Dict[str, float] = {}  # domain -> timestamp
+        self.cache_ttl = 86400  # 24 hours in seconds
+        self.api_available = True
+        self.last_api_check = time.time()
+        self.fallback_legit_domains = {
+            'amazon.com', 'amazon.co.uk', 'amazon.in', 'netflix.com', 'spotify.com', 'apple.com',
+            'google.com', 'microsoft.com', 'paypal.com', 'ebay.com', 'walmart.com',
+            'target.com', 'bestbuy.com', 'costco.com', 'fedex.com', 'ups.com', 'usps.com',
+            'airlines.com', 'ba.com', 'united.com', 'delta.com', 'jetblue.com',
+            'library.org', 'cvs.com', 'walgreens.com', 'riteaid.com', 'shopify.com',
+            'slack.com', 'zoom.us', 'gmail.com', 'outlook.com', 'yahoo.com',
+            'flipkart.com', 'myntra.com', 'swiggy.com', 'zomato.com', 'makemytrip.com', 'yatra.com',
+            'cleartrip.com', 'paytm.com', 'phonepe.com', 'hdfcbank.com', 'onlinesbi.sbi', 'icicibank.com',
+            'axisbank.com', 'kotak.com', 'airindia.in', 'goindigo.in', 'irctc.co.in', 'redbus.in',
+            'olacabs.com', 'hotstar.com', 'sonyliv.com', 'zee5.com', 'jiocinema.com',
+            'timesofindia.indiatimes.com', 'hindustantimes.com', 'thehindu.com', 'ndtv.com', 'moneycontrol.com',
+            'bseindia.com', 'nseindia.com', 'naukri.com', 'shaadi.com', 'bharatmatrimony.com',
+            'bookmyshow.com', 'policybazaar.com', 'nykaa.com', 'ajio.com', 'firstcry.com',
+            'bigbasket.com', 'blinkit.com', 'zepto.com', 'upstox.com', 'groww.in', 'zerodha.com',
+            'airtel.in', 'jio.com', 'myvi.in', 'vi.com', 'bsnl.co.in', 'tataplay.com', 'dishtv.in',
+            'sbicard.com', 'bajajfinserv.in', 'cred.club',
+            # Tech/Development domains
+            'github.com', 'gitlab.com', 'bitbucket.org', 'stackoverflow.com', 'developer.mozilla.org',
+            'npm.com', 'pypi.org', 'docker.com', 'heroku.com', 'aws.amazon.com',
+            'azure.microsoft.com', 'gcp.google.com', 'atlassian.com', 'jira.com', 'confluence.com'
+        }
+    
+    def _is_cache_valid(self, domain: str) -> bool:
+        """Check if cached result is still valid."""
+        if domain not in self.cache_timestamps:
+            return False
+        return (time.time() - self.cache_timestamps[domain]) < self.cache_ttl
+    
+    def _check_safe_browsing_api(self, domain: str) -> Optional[str]:
+        """
+        Query Google Safe Browsing API for known threats.
+        Returns known_malicious if threats are found, unknown if no match exists,
+        and None if the API could not be queried.
+        """
+        if not self.api_key:
+            return None
+        
+        try:
+            payload = {
+                "client": {
+                    "clientId": "smishing-detector",
+                    "clientVersion": "1.0"
+                },
+                "threatInfo": {
+                    "threatTypes": THREAT_TYPES,
+                    "platformTypes": PLATFORM_TYPES,
+                    "threatEntries": [
+                        {"url": f"http://{domain}"},
+                        {"url": f"https://{domain}"}
+                    ]
+                }
+            }
+            
+            response = requests.post(
+                f"{SAFE_BROWSING_API_URL}?key={self.api_key}",
+                json=payload,
+                timeout=5
+            )
+            
+            if response.status_code == 200:
+                data = response.json()
+                if data.get("matches"):
+                    return "known_malicious"
+                # Safe Browsing is a blocklist. No match means "not known bad",
+                # not proof that a new phishing domain is legitimate.
+                return "unknown"
+            else:
+                # Log the error response for debugging
+                error_msg = f"Safe Browsing API returned {response.status_code} for {domain}"
+                try:
+                    error_details = response.json()
+                    error_msg += f": {error_details}"
+                except:
+                    error_msg += f": {response.text}"
+                print(error_msg)
+                
+                # API error - mark API as unavailable for a while
+                self.api_available = False
+                self.last_api_check = time.time()
+                return None
+                
+        except requests.exceptions.Timeout:
+            print(f"Safe Browsing API timeout for {domain}")
+            self.api_available = False
+            self.last_api_check = time.time()
+            return None
+        except Exception as e:
+            print(f"Safe Browsing API error for {domain}: {e}")
+            return None
+    
+    def is_domain_legitimate(self, domain: str) -> bool:
+        """
+        Check if a domain is legitimate using Google Safe Browsing API.
+        Falls back to cached hardcoded domains if API is unavailable.
+        
+        Args:
+            domain: Domain name to check (e.g., 'google.com')
+            
+        Returns:
+            True if domain appears safe, False otherwise
+        """
+        # Normalize domain
+        domain = domain.lower().strip()
+        
+        # Check cache first
+        if domain in self.cache and self._is_cache_valid(domain):
+            return self.cache[domain] == "known_safe"
+        
+        # Check hardcoded fallback list (always trust these)
+        if domain in self.fallback_legit_domains:
+            self.cache[domain] = "known_safe"
+            self.cache_timestamps[domain] = time.time()
+            return True
+        
+        # Try API if available - will detect known malicious domains
+        if self.api_available or (time.time() - self.last_api_check) > 300:  # Retry every 5 minutes
+            result = self._check_safe_browsing_api(domain)
+            if result is not None:
+                # result=True means GSB found NO threats → domain is safe
+                # result=False means GSB found threats → domain is dangerous
+                self.cache[domain] = result
+                self.cache_timestamps[domain] = time.time()
+                return self.cache[domain] == "known_safe"
+
+        # API unavailable — conservatively treat unknown domains as not legitimate
+        self.cache[domain] = "unknown"
+        self.cache_timestamps[domain] = time.time()
+        return False
+    
+    def check_domain_status(self, domain: str) -> str:
+        """Return known_safe, known_malicious, or unknown for a domain."""
+        domain = domain.lower().strip()
+        self.is_domain_legitimate(domain)
+        return self.cache.get(domain, "unknown")
+
+    def clear_cache(self):
+        """Clear the domain cache."""
+        self.cache.clear()
+        self.cache_timestamps.clear()
+
+
+# Global instance
+_checker = None
+
+
+def get_checker() -> SafeBrowsingChecker:
+    """Get the global Safe Browsing checker instance."""
+    global _checker
+    if _checker is None:
+        _checker = SafeBrowsingChecker()
+    return _checker
+
+
+def is_domain_legitimate(domain: str) -> bool:
+    """
+    Check if a domain is legitimate using Google Safe Browsing API.
+    
+    Args:
+        domain: Domain name to check (e.g., 'google.com')
+        
+    Returns:
+        True if domain appears safe, False otherwise
+    """
+    return get_checker().is_domain_legitimate(domain)
+
+
+def check_domain_status(domain: str) -> str:
+    """Return known_safe, known_malicious, or unknown for a domain."""
+    return get_checker().check_domain_status(domain)
+
+
+def clear_domain_cache():
+    """Clear the domain legitimacy cache."""
+    get_checker().clear_cache()