CallShield

CallShield blocks spam calls and texts using a 15-layer on-device detection engine with an ML spam scorer, RCS notification filter, and real-time caller ID overlay. Powered by a 32,933-number database with 30-minute hot list updates. Community-maintained, no accounts, no tracking.

How It Works

1. 32,933 confirmed spam numbers — sourced from 1.75M FCC consumer complaints (2+ reports each), FTC Do Not Call, ToastedSpam, and community reports 2. 15-layer detection + ML — database, heuristics, on-device logistic regression, SMS content analysis, RCS filter, STIR/SHAKEN, and more 3. Real-time caller ID overlay — parallel lookups against SkipCalls, PhoneBlock, WhoCalledMe + OpenCNAM caller name, with SIT tone anti-autodialer 4. 30-minute hot list — trending spam numbers and campaign ranges refresh every 30 minutes via GitHub Actions 5. Callback-aware — won't block callbacks from numbers you recently called, or urgent repeated callers 6. Community-driven — one-tap anonymous contribution via Cloudflare Worker, daily merge into database

Detection Layers

- Layer Manual Whitelist: Numbers you've explicitly marked as always-allow - Layer Contact Whitelist: Numbers in your phone's contacts always pass through - Layer Callback Detection: Numbers you recently called (24h) are allowed — they're callbacks - Layer Repeated Urgent Caller: Same number calls 2x in 5 minutes → allowed through - Layer User Blocklist: Your personal block list with descriptions - Layer Database Match: 32,933 confirmed spam numbers + hot list (refreshed every 30 min) - Layer Prefix Rules: Wangiri country codes, US premium rate (+1900), international premium - Layer Wildcard / Regex: Custom pattern rules like +1832555* or full regex - Layer Quiet Hours: Block all non-contact calls during configurable hours - Layer Frequency Auto-Block: Numbers that call 3+ times get automatically blocked - Layer Heuristic Engine: VoIP ranges, neighbor spoofing, rapid-fire, hot campaign range detection - Layer Caller ID Overlay: Suspicious calls (score 30-59) get live multi-source lookup - Layer SMS Keyword Rules: Block texts containing specific words you define - Layer SMS Content Analysis: 30+ regex patterns, URL shorteners, suspicious TLDs, spam domain blocklist - Layer ML Spam Scorer: 15-feature on-device logistic regression model (weekly retrained)

Additional Layers

- SMS Context Trust — messages from numbers you've texted or received from on 2+ days are allowed - RCS Filter — NotificationListenerService monitors Google/Samsung Messages for RCS spam - URL Safety — URLhaus (abuse.ch) checks for phishing/malware URLs in SMS/RCS (post-decision, notification only) - STIR/SHAKEN — blocks calls failing carrier caller ID verification (Android 11+)

Live Caller ID Overlay

When a call comes in, CallShield shows a real-time overlay that queries 4 sources simultaneously:

┌──────────────────────────────────┐ │ LIKELY SPAM │ │ (212) 555-1234 │ │ New York, NY │ │ Spam Score: 80% (17 reports) │ │ JOHN DOE (OpenCNAM) │ │ ⚠ SkipCalls: Flagged │ │ ⚠ PhoneBlock: 5 reports │ │ ⚠ WhoCalledMe: 12 reports │ │ All sources checked │ │ [Search] [Block] [Dismiss] │ │ 🔈 Play SIT Tone (anti-dialer) │ └──────────────────────────────────┘

- Shows instantly with area code, then updates live as each source responds - OpenCNAM caller name lookup (free, 60 req/hr) - SIT Tone — ITU-T E.180 three-tone sequence tricks autodialers into removing your number - Color-coded: green (safe) → yellow → orange → red (spam)

ML Spam Scorer

On-device 15-feature logistic regression model — no TFLite, no heavy ML libraries. Pure math, runs in microseconds.

- Feature toll_free: Description 800/888/877/etc. prefix - Feature high_spam_npa: Description Area code in high FTC/FCC complaint set - Feature voip_range: Description NPA-NXX in known VoIP spam carrier range - Feature repeated_digits_ratio: Description Fraction of most-common digit - Feature sequential_asc/desc_ratio: Description Sequential digit pairs - Feature all_same_digit: Description All 10 digits identical - Feature nxx_555: Description Exchange is 555 (test numbers) - Feature last4_zero: Description Subscriber is 0000 - Feature invalid_nxx: Description NXX starts with 0 or 1 (NANP-invalid) - Feature subscriber_all_same: Description Last 4 digits all same (9999) - Feature alternating_pattern: Description Even/odd positions uniform (5050505050) - Feature nxx_below_200: Description Often unassigned ranges - Feature low_digit_entropy: Description Fewer than 4 distinct digits - Feature subscriber_sequential: Description Last 4 form ascending/descending run

Trained weekly from the CallShield database (50K positive + 50K negative samples). Threshold: 0.7 (conservative).

Features

Number Lookup

- Instant spam check through all 15 detection layers with animated score gauge (0-100) - Auto-paste from clipboard, area code lookup (330+ US/CA), haptic feedback - Multi-source reverse lookup: SkipCalls + PhoneBlock + WhoCalledMe + OpenCNAM

Recent Calls & Blocked Log

- Recent calls with contact names, risk indicators, call type icons, filter chips (All/Missed/Spam) - Blocked log with swipe-to-dismiss + undo, grouping with severity-scaled accent bars, filter chips - Staggered entrance animations, shimmer loading skeletons

Rules Management (5 tabs)

- Blocklist, Wildcards, Keywords, Whitelist, Database - Export/import blocklists as JSON, per-rule enable/disable toggles - Regex validation before adding wildcard rules

Statistics

- Weekly bar chart, detection method breakdown, top offenders, area code heatmap, hourly heatmap

Smart Features

- Smart suggestions — detects area code spam patterns, one-tap block entire area code - Weekly trend indicator — shows if spam is increasing or decreasing vs last week - Last blocked preview card on dashboard with tap-to-inspect - Blocking profiles: Work / Personal / Sleep / Maximum / Off - Callback detection + repeated urgent caller allow-through - FTC Do Not Call complaint filing

Community

- One-tap anonymous contribution via Cloudflare Worker - False positive reporting subtracts votes - Share spam warnings to any app

Data & System

- Full backup/restore, CSV log export, auto-cleanup (7/14/30/90 days) - Weekly full sync + 30-minute hot list refresh, daily digest notification - Quick Settings tile, app shortcuts, home screen widget - Protection test validates all layers and permissions - Onboarding wizard with permission requests

Data Sources

Database (32,933 numbers, weekly CI)

- Source FCC Consumer Complaints: Method Socrata API, 500K records, min 2 reports - Source FTC Do Not Call: Method api.ftc.gov (DEMO_KEY) - Source ToastedSpam: Method Community curated list - Source Community Reports: Method Anonymous via Cloudflare Worker

Hot List (30-minute refresh)

- File hot_numbers.json: Contents Top 500 trending numbers (last 24h) - File hot_ranges.json: Contents NPA-NXX prefixes with 3+ active campaign numbers - File spam_domains.json: Contents Phishing/spam domains from community SMS reports

Real-Time Lookup (overlay only)

- Source SkipCalls: What It Returns spam flag, 1M+ numbers, Auth None - Source PhoneBlock.net: What It Returns Votes, rating, blacklist, Auth None - Source WhoCalledMe: What It Returns Report count, notes, Auth None - Source OpenCNAM: What It Returns Caller name (CNAM), Auth None (60/hr) - Source AbstractAPI: What It Returns Carrier, line type, Auth Optional key

URL Safety (post-decision)

- Source URLhaus (abuse.ch): What It Checks Phishing/malware URLs in SMS/RCS bodies

Privacy

All detection runs on-device. No personal data is collected. Network requests:

- Syncing spam database from GitHub (public) - Real-time lookups against free public APIs (number queried, not stored) - Community reports to Cloudflare Worker (phone number only, no identity) - URLhaus checks for SMS URL safety (URL only)

No API keys required. No accounts. No analytics. No ads.

License

CallShield is licensed under the MIT License.