Windshock Lens

Windshock Lens triages suspicious links and pages directly inside Chrome — before you click, before the page steals credentials, before a malicious download lands on disk. It is built for the gray zone that Chrome Safe Browsing and standard endpoint security tools miss: zero-hour brand-impersonation pages on free hosting platforms (workers.dev, pages.dev, firebaseapp.com, vercel.app, …), AI-client lookalikes, fake software download pages, and ClickFix shell-payload tricks. How it works Windshock Lens combines four independent signal layers: 1. Browser-side page extraction — the DOM, forms, links, clipboard writes, and downloads triggered by the target page are collected without sending the page anywhere. 2. On-device Gemini Nano LLM — Chrome's built-in language model evaluates the extracted signals locally. Page content, URLs, and OCR text never reach an external LLM API. 3. Deterministic security rules — hard evidence (shell payload on clipboard, dangerous URI schemes, auto-downloads, phishing-kit fingerprints) yields a verdict without the LLM. Brand-to-domain mismatch overrides catch impersonation patterns the LLM misses. 4. Ownership corroboration — RDAP + Certificate Transparency lookups for the target domain confirm or contradict the LLM's brand identification. What it actually catches - Brand-mimic pages on workers.dev / pages.dev / firebaseapp.com / appspot.com hosting - ClickFix attacks that paste curl ... | sh into your clipboard via fake "verify you are human" buttons - AppleScript / ms-msdt / vbscript URI scheme abuse - Phishing kits using clearbit logos, screenshotmachine, atob() URL hiding, Telegram/Discord webhook exfiltration - Auto-downloads of executable installers from phishing-hosted pages — the download is paused, the host is scanned, then cancelled and erased if phishing What stays on your device - Page content, URLs, OCR text — processed only by the local Gemini Nano model - Bookmarks, history, top sites — read only, never transmitted (used to mark sites you already trust) - Verdicts and denylist hashes — stored in chrome.storage local to your profile What leaves your device - The bare domain name of each scanned host goes to public WHOIS / RDAP / Certificate Transparency services (yesnic / rdap.org / crt.sh) to verify domain ownership. No page content, no path, no query string, no user identity. Requirements - Chrome 138 or later - Gemini Nano on-device model (~2 GB, one-time download). Enable at chrome://on-device-internals. Full privacy policy: https://github.com/windshock/lens/blob/main/docs/privacy.md Source code and issue tracker: https://github.com/windshock/lens