How to detect smart contract phishing early when users sign multiple transactions in quick succession?

I'm researching how ScamSniffer detects phishing behavior at the smart contract level, especially when users sign many transactions in a short period. In reality, these transactions look quite normal, making them difficult to distinguish from the real thing at first.

It's unclear which signals ScamSniffer prioritizes for risk assessment in this situation (signing patterns, granted privileges, or contract behavior). I hope everyone can share their experience or effective approaches for handling similar cases.

@Steal Brainrot Game