Evidence OverviewLOCAL WORKSPACE
Cases01Active investigation
Evidence items00Added to this case
Flagged signals00Rule-based indicators
DIGITAL FORENSICS / CASE INTELLIGENCE
Every scam
leaves a trail.
Check suspicious messages, understand the warning signs, and choose a safer next step.
INVESTIGATION HUB / CASE OVERVIEW
Dashboard
Review evidence activity, risk signals, and investigation coverage in one workspace.
Detection Coverage
07Signal families
03Forensics tools
01Correlated case view
Coverage describes available prototype features, not independently validated detection performance.
Flag Summary
00Indicators in current workspace
High risk 00Review 00Informational 00
Finding Severity
00Signals
00 High / urgent00 Needs review00 Informational
Counts update from evidence added to this browser session.
Investigation WorkflowCASE FLOW
Recent Flags
No flags in this session yetRun Quick Check or add evidence to populate this panel.
SCAMCHAIN INVESTIGATION ENGINE
Scams unfold in sequences.
Investigate the whole chain.
Bring messages, URLs, identities and payment events together. ScamChain extracts visible indicators, links shared entities, orders evidence in time and explains the suspected workflow—without presenting an inference as a proven fact.
CHAIN MAP / CONCEPT EVENT CORRELATION
Observed signal Entity link Inferred stage
SAFETY RESPONSE · DASHBOARD
Worried you may have been scammed?
Choose what happened to see the safest next step. A high indicator alone does not mean money was lost.
Do not reply, click further links, share codes or approve requests. Verify the sender independently.
THE PIPELINE
From fragmented signals to a reviewable case
Ingest evidence
Normalize messages, emails, URLs and payment-related events.
Extract & resolve
Find visible entities and link exact matches across evidence items.
Correlate in time
Order events and inspect the intervals between them.
Explain the chain
Build a graph, surface gaps and show why a workflow looks suspicious.
CURRENT CASE
Investigation snapshot
No evidence has been added. Start a case or load the fictional example.
RAKSHAM-ALIGNED DESIGN
Signals that matter together
Language & intentIdentityURL / domainTemporal patternPayment actionThreat context
This web prototype uses transparent extraction and correlation rules. Live threat-intelligence lookup and trained-model inference are not represented as active unless a connected service actually returns them.
CONSUMER SAFETY · QUICK CHECK
Pause. Paste. Understand.
Check a suspicious message before acting. Use fictional or redacted text—never enter passwords, OTPs, full account numbers or private conversations you do not have permission to share.
Local screening runs in this browser. Connected analysis is optional.
This is a prototype triage aid, not proof that a message is safe or fraudulent. Never act on the result alone.
EXPLAINABLE RESULT
Ready to check
Paste a message and choose Check this message. You will see the signals detected and safer next steps.
01 / EVIDENCE INGESTION
Build the case from separate events
Add each signal as its own record. Preserve the source channel and timestamp so the relationship between events can be examined.
New evidence event
Use fictional or redacted data. Never enter passwords, OTPs or full account numbers.
Evidence collected
Every record remains separately inspectable.
Your evidence records will appear here.
CORRELATION OUTPUT
What the evidence supports
Add two or more evidence items for a meaningful cross-event correlation. A single event can still be screened, but it cannot establish a multi-stage chain.
02 / ATTACK-GRAPH CONSTRUCTION
Explore the suspected workflow
Edges show exact entity overlap or explicitly labeled inferred stage links. A graph connection is not proof of causation.
Case relationship graph
No case correlated yet. Add evidence to generate a case-linked graph.
Evidence event Shared entity Inferred stage
Select a graph node to inspect its provenance.
RECONSTRUCTED STORYLINE
How the suspected scam unfolds
Follow the evidence from the first contact to the latest observed action. Each step links back to the event that supports it.
Load the fictional case or add evidence, then select Correlate & reconstruct to build the timeline story.
THREAT TREE · ROOT → BRANCH → EVIDENCE
Attack path and defensive breakpoints
Each branch is built from matched stage rules and the evidence items that triggered them. Select a branch to inspect its supporting records.
Correlate a case to build the threat tree. Branches are hypotheses, not verified attacker intent.
TEMPORAL REASONING
Event sequence
No timeline available.
REASONING BOUNDARY
Observed vs inferred
ObservedText or metadata explicitly present in a submitted evidence item.
LinkedExact matching entity value appears in more than one event.
InferredRule-based candidate stage; requires corroboration before treating it as fact.
03 / EXPLAINABILITY & HUMAN REVIEW
Evidence ledger
Every finding should be traceable to an input. Missing evidence is surfaced instead of silently filled in.
Evidence records
Submitted items, source channels and timestamps.
No evidence records yet.
Risk reasoning
Indicators and evidence gaps.
Correlate evidence to see the case reasoning.
SAFETY & LIMITATIONS
- Indicator score is a prototype index, not a calibrated fraud probability.
- Exact string matches do not prove common ownership or intent.
- Timestamp order does not prove causality.
- No live URL reputation, account ownership or transaction verification is claimed.
- Use human review before any consequential action.
04 / EMAIL FORENSICS · LOCAL-FIRST
Know who the email claims to be from.
Classify email risk, inspect sender identity, compare From / Reply-To / Return-Path, and read reported SPF, DKIM and DMARC results. Supports Gmail, Outlook / Microsoft 365, Yahoo and custom mailboxes without connecting an account.
EMAIL INTELLIGENCE PIPELINE
From provider context to evidence-backed triage
ScamChain separates the mailbox you use from the identity a message claims. Select where you received it, then inspect the message itself. Gmail or Outlook is not automatically the sender's true identity.
GmailOutlook / Microsoft 365Yahoo MailCustom domain
WHAT THE CHECKS MEAN
Three authentication signals
- SPF: whether the sending server is authorized for the envelope-sender domain.
- DKIM: whether a domain signature is reported as valid.
- DMARC: whether SPF or DKIM aligns with the visible From domain under the domain's policy.
These values are read from pasted headers; this browser demo does not perform cryptographic validation or live DNS lookups. Authentication is one signal, not a complete verdict: mailbox providers may also consider sender reputation, history and behavior.
Research references: Google sender guidelines · Microsoft 365 authentication · DMARC standard (RFC 7489)
01 / EMAIL INPUT
Inspect a message
Paste an email or load a local .eml file. Nothing is uploaded.
Use fictional or redacted data. Do not paste passwords, OTPs, or private mail without permission.
This tool does not sign in to Gmail or Microsoft, read your inbox, verify live URLs, scan attachments, or send message content to a server.
02 / EXPLAINABLE CLASSIFICATION
Findings and evidence
Load a fictional example or paste an email, then select Analyze email. The report will show the category, indicator index, authentication text, and specific reasons.
Compare the visible From address with Reply-To, Return-Path, claimed brand, and extracted link hosts.
Detect urgency, credential collection, payment changes, secrecy pressure, and suspicious attachment language.
Load the same fictional cases into the simulation lab to demonstrate how evidence becomes an understandable warning.
05 / VIRTUAL USER EXPERIENCE
Simulation lab: experience the scam
A safe, fictional phone-and-browser environment. Choose a scenario, inspect messages, and see where ScamChain would warn a user. No real messages, payments or websites are contacted.
9:41●●● ▰
MessagesVirtual user inbox
DEMO Simulated device · local interactions only
CHOOSE A SCENARIO
What does the user encounter?
Make it easier to useDesigned for every age and experience level
Scenarios and domains are fictional training examples. This lab does not open external links or verify real-world reputation.
SCAMCHAIN GUARD
Waiting for user interaction
Open a message on the virtual phone. ScamChain will explain the visible warning signals and offer safer next steps.
Judge view: select a scenario, then interact with the virtual screen.
INVESTIGATION ENGINE
Signals connected so far
Interact with the scenario to reveal its stages.
Stages are a scripted demonstration of the intended workflow, not evidence of a real incident. Production detection requires validation against labeled cases.
IF SOMETHING ALREADY HAPPENED
Get the right next step
Choose what happened. This guide is informational and does not contact your bank or submit a report for you.
Choose an option above.
You will see a short checklist for that situation.
India: if money may have been lost, call 1930 immediately and notify your bank or UPI provider. You can also report at cybercrime.gov.in. Use official channels; never pay anyone who promises to recover money for a fee.
PANDORASHIELD × SCAMCHAIN
Protection actions, connected to investigation.
PandoraShield’s extra layer lives here: guided response, practical protection steps, and ready-to-run scenarios. ScamChain keeps the actual message screening, email analysis, evidence ledger and attack-chain investigation—no duplicate scanners.
SAFETY RESPONSE
What happened?
Choose the action already taken to get a focused response plan. A warning is not proof that an account or device is compromised.
Choose a situation and select “Show my next steps”.
PROTECTION CHECKLIST
Reduce the chance of a repeat
Mark the practical steps completed for this session. This checklist is local to the current page and is not a device-wide protection service.
0 of 5 completed
LOAD & TEST
Five realistic demo scenarios
Choose a scenario to load its fictional sample into ScamChain Quick Check. Then run the existing analysis—these are test fixtures, not real victims or live threats.
Account suspension lure
Urgency + bank impersonation + OTP request.
Fake parcel fee
Delivery pretext + small fee + suspicious URL.
Prize claim email
Unexpected reward + credential collection.
Remote support app
Untrusted install + screen access request.
Incoming payment trick
Collect request + pressure to enter UPI PIN.
SELECTED TEST FIXTURE
No scenario selected
Choose any example above. It will be loaded into the existing ScamChain Quick Check.
USE THE EXISTING ENGINES
Choose the next step
TEXT FORENSICS
Three tools. One workspace.
Inspect hidden characters, compare writing patterns, and trace tagged text.
Reveal invisible text
Find zero-width characters, directional controls and selected lookalike characters.
Compare writing patterns
Compare simple linguistic measurements between a known baseline and a suspect message.
Trace tagged text
Embed and recover an invisible source marker in copied text. This is not encryption.
01 / UNICODE FORENSICS
X-Ray Vision
Paste a suspicious message, domain or URL. The scan checks a configured set of invisible and lookalike characters locally.
02 / LINGUISTIC FORENSICS
Imposter ID · Stylometry
Compare a message with a known writing sample. Keep both samples in the browser; short or contextually different text can create misleading differences.
03 / TEXT TRACE MARKER
Project Canary
Add an invisible marker to text you control, then check whether the marker is present in a later sample. Copying apps may strip zero-width characters, and anyone who receives the text may also copy or forge the marker.
No marker generated.