Smishing & Spam SMS Regex Filter / iOS & Android Blocking Rule Tester (2026)

Attackers replace standard Latin ASCII letters (`a`, `e`, `o`, `p`, `c`) with identical-looking Cyrillic or Greek Unicode codepoints (for example, Cyrillic small letter `а` U+0430 instead of Latin `a` U+0061). To a human reader, `pаypal.com` or `Vеrizon` looks completely normal, but naive keyword filters looking for the ASCII byte sequence `paypal` fail to match.

Bulk domain registrars sell `.top`, `.xyz`, `.vip`, and `.icu` domains for under $0.99 in automated batches of thousands. Threat actors register domains like `usps-track-parcel88.top`, blast 50,000 SMS messages via SIM-box farms or compromised RCS accounts within 2 hours, and abandon the domain as soon as blocklists catch up.

For privacy reasons, Apple's `IdentityLookup` framework only sends SMS messages from **unknown senders** (numbers not in your Contacts and to whom you haven't replied at least 3 times) to the on-device filter extension. Furthermore, offline extensions run in a network-isolated sandbox so your SMS contents cannot be leaked to external servers unless the user explicitly enables cloud lookup.

Broad keyword blocks on terms like `verify`, `security`, `account`, or `code` produce catastrophic False Positives by routing legitimate 6-digit 2FA OTPs from banks, Google, and healthcare portals into the silent Junk folder. High-precision regex rules anchor on structural combinations—such as urgency verbs paired with non-official URLs (`https?://(?!(?:www\.)?(?:chase|usps)\.com)`).

No. Regex execution, Unicode codepoint inspection, and corpus scoring happen 100% locally inside your browser tab.