feeds: loading…

SPF · DKIM · DMARC · spoofing · attachments · links
Headers are where liars get caught. TrustLens checks authentication results, envelope mismatches, brand impersonation, dangerous attachments — and fetches every link inside.
Community-powered blocklist: every report makes the next person safer. Pattern analysis catches spoofed/sequential fake numbers too.
Fake banking/trading APKs empty accounts. Hash check + dangerous permission combos (OTP theft, overlay attacks, droppers). Get permissions via adb shell dumpsys package <app>.
RDAP scan for lookalike domains
0
/100
— 

POST /api/scan            {"input":"https://example.com","mode":"auto"}   → full verdict (URL/message/QR)
POST /api/analyze         {"text":"suspicious SMS/message text"}           → message verdict
POST /api/analyze-email   raw .eml text or {"raw":"..."}                   → SPF/DKIM/DMARC + spoof + link scan
POST /api/phone           {"number":"+91 98765 43210"}                     → scam-number verdict
POST /api/phone/report    {"number":"...","category":"scam","note":"..."}   → grow the community blocklist
POST /api/apk             {"hash":"sha256…","permissions":["SEND_SMS",…]}   → fake-app verdict
GET  /api/watch           → brand radar watchlist       POST /api/watch {"domain":"x.com","webhook":"…"}
POST /api/watch/check     → RDAP radar pass (new lookalike alerts)       DELETE /api/watch?domain=x.com
GET  /api/stats           → live trends (scans, verdict mix, recent scams)
GET  /api/intel/misp      → MISP feed        GET /api/intel/stix → STIX 2.1        GET /api/intel/hosts.txt → plain host list
POST /api/bulk            {"urls":[…]} or raw CSV (≤100/job) · ?format=csv → scored CSV export
GET  /api/health          → liveness · GET /api/feeds → feed status · GET /v/<token> → shared verdict page