NetArmature scans the page you're on for signs of a scam — fake job postings, rental listings, travel bookings, and money-transfer/payment sites — and shows a quiet toolbar badge when something looks risky (no popups, no page banners).

What it checks:
- Suspicious redirect chains that land you on an unrelated domain
- Brand impersonation (a known company's name on a domain that isn't theirs)
- Domain age and registration info via public RDAP lookups
- Common scam-page language patterns (urgency, payment requests, etc.)

Everything runs locally in your browser — no account, no data sent to any server we run.

This version significantly expands scam-brand detection coverage (400+ banks, fintechs, and travel/booking brands worldwide, up from a much smaller initial set), completes full translation of all phishing-detection logic into all 10 supported languages (previously several detection phrases were English-only), and adds two new detection signals: suspicious/disposable top-level domains, and near-empty page content on free hosting platforms — both common patterns in real-world phishing pages we tested against.

Note on the "Unsafe assignment to innerHTML" validation warning: all innerHTML assignments in popup.js insert only static, hardcoded translation strings, numbers, or empty placeholder elements. Any text derived from the analyzed page itself (page title, detected brand names, error messages that may echo page content) is deliberately filled in afterward via textContent rather than spliced into the innerHTML template — textContent is never interpreted as markup by the browser, so this pattern prevents a malicious page from injecting content into the extension's own popup UI. This design is intentional and documented in code comments at each site.