spamscanner/spamscanner

What it solves

It provides a comprehensive spam filter for Node.js, command-line interfaces, and mail servers. It protects against spam, phishing, scams, and malware across multiple languages, providing transparent explanations for every classification decision.

How it works

The system uses a multi-layered approach to detect threats:

• Multilingual Classifier: A classifier that handles various languages (including Chinese, Japanese, and Thai) by segmenting words using Unicode rules and cleaning lookalike letters or invisible characters.
• Phishing & Attachment Checks: It scans for lookalike domains, deceptive links, and malicious attachments (including executables hidden as PDFs or within ZIP files).
• Protocol Checks: It verifies SPF, DKIM, DMARC, and ARC, and checks DNS blocklists.
• LLM Integration: For "close calls," the tool can query local or remote language models (such as Ollama, Claude, ChatGPT, or Gemini) to get a probability-based verdict.
• Explainability: Every result lists the specific tests that fired and their associated points, similar to SpamAssassin.

Who it’s for

Developers and system administrators who need to integrate spam filtering into Node.js applications, mail servers (Postfix, Sendmail, Exim, Haraka), or use it as a standalone CLI tool.

Highlights

• Broad Compatibility: Works as a Node.js library, CLI, HTTP API, TCP server, or mail server milter.
• LLM-Augmented Decision Making: Can leverage LLMs for ambiguous cases while removing personal data before sending to remote providers.
• Deep Inspection: Detects complex phishing tricks like punycode and right-to-left filename tricks.
• Trainable: Supports training on custom mbox files, Maildirs, or datasets.