title	AnLinkCheck — AI URL Trust & Scam Analyzer
emoji	🔗🛡️
colorFrom	red
colorTo	yellow
sdk	docker
app_port	7860
pinned	false

🔗🛡️ AnLinkCheck

AI-powered website trust, scam & security analyzer. Paste any link — including shortened ones from WhatsApp/Telegram/email — and get an evidence-backed verdict.

What it does

URL → SSRF guard → rate limiter → cache → redirect expander
    → crawler (httpx → Playwright Chromium fallback)
    → domain intel (whois age, registrar, SSL) ┐
    → content signals (PII forms, downloads,   ├─ parallel
      obfuscated JS, urgency language)         │
    → reputation (Google Safe Browsing,        ┘
      VirusTotal, OpenPhish, DuckDuckGo search)
    → weighted rule score + Groq LLM verdict
    → SQLite evidence store → chat about findings (BM25 RAG)

System-design & security layer

Component	Where	Why
SSRF guard	linkcheck/infra/ssrf.py	User URLs are fetched server-side; blocks loopback/RFC1918/link-local/metadata IPs, re-checked on every redirect hop and inside the browser via route interception
Token-bucket rate limiting	linkcheck/infra/ratelimit.py	Per-client scan budget (3 burst, refill 1/2min) + outbound budget respecting VirusTotal's 4 req/min free tier
Redis-style TTL cache	linkcheck/infra/cache.py	In-process get/set with TTL + LRU eviction; scan 24h, whois 7d, reputation 12h. Single-flight dedups concurrent identical scans
Circuit breakers	linkcheck/infra/circuit.py	One per external API (closed → open → half-open); a dead source degrades to "skipped", never a failed scan
Concurrency control	crawler.py	Semaphore(1) around Chromium; response caps 5MB / 15s / 10 redirect hops

Configuration (HF Space secrets — all optional)

Secret	Purpose	Free tier
GROQ_API_KEY	AI verdict + evidence chat	console.groq.com
VT_API_KEY	VirusTotal reputation	4 req/min
GSB_API_KEY	Google Safe Browsing	Google Cloud console

Missing keys degrade gracefully: rule-based verdict + keyless sources (OpenPhish feed, DuckDuckGo search, whois, SSL) still work.

Run locally

pip install -r requirements.txt
playwright install chromium
cp .env.example .env   # add your keys
python app.py          # http://localhost:7860