About moat.
moat exists for the moment someone sends you a screenshot and asks: is this real? A delivery text, a bank alert, a login page, a message from a friend who suddenly sounds like a stranger.
Most security tooling is built for companies. The scams are aimed at people: parents, grandparents, anyone busy enough to tap a link without squinting at it first. moat is the tool you reach for before anything gets tapped. Screenshot it, drop it in, get a verdict. No installs, no plugins, no jargon.
How a verdict happens
Behind the scenes, your screenshot moves through four stages in a few seconds.
Read
moat extracts every line of on-screen text from the image and screens out interface noise like clocks and battery icons. It also tracks how confident it is in each line: if a screenshot is too blurry to read reliably, moat says so instead of guessing.
Extract
From that text it pulls the pieces that matter: links, email addresses, phone numbers, money amounts, and deadlines. Each one stays tied to its exact spot in the image, so anything flagged later can be pointed at, not just described.
Check
Suspicious pieces are checked against the live web: whether a domain really belongs to the brand it imitates, whether the sender matches who it claims to be, and whether the wording matches scam campaigns in circulation right now.
Decide
The gathered evidence is weighed into one verdict, safe, suspicious, or malicious, with the reasons spelled out in plain language and the risky parts highlighted on your screenshot.
A real example
One of our test screenshots is a text about a stalled Royal Mail parcel. It looks routine: a package number, a redelivery deadline, a link. But the link reads royalmaill, with two Ls. moat reads the message, spots the look-alike domain and the artificial deadline, checks the domain against the real Royal Mail, and returns a verdict of malicious with the link highlighted on the image. That one extra letter is the whole scam. Catching it is exactly what software is for.
What we don’t keep
Screenshots are processed in memory, not retained beyond the duration of your verdict request, and never used to train models. There are no analytics scripts or trackers riding along. The full details live in our privacy policy.